CVE-2023-28633 — Server-Side Request Forgery in Glpi

CWE-918 — Server-Side Request Forgery1 documents1 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 52.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedApr 5

Description

GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶NVDglpi-project/glpi0.84 — 9.5.13+1
▶CVEListV5glpi-project/glpi>= 0.84, < 9.5.13, >= 10.0.0, < 10.0.7+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗