CVE-2022-24876 — Cross-site Scripting in Glpi

CWE-79 — Cross-site Scripting1 documents1 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 57.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedJun 9

Description

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5glpi-project/glpi< 10.0.1
▶NVDglpi-project/glpi10.0.0

Patches

Patch: github.com ↗Patch: github.com ↗