CVE-2023-28636 — Cross-site Scripting in Glpi

CWE-79 — Cross-site Scripting2 documents2 sources
Severity
4.8MEDIUMNVD
EPSS
1.0%
top 23.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedApr 5

Description

GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶NVDglpi-project/glpi0.60 — 9.5.13+1
▶CVEListV5glpi-project/glpi>= 0.60, < 9.5.13, >= 10.0.0, < 10.0.7+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
OSV
CVE-2023-28636: GLPI is a free asset and IT management software package↗2023-04-05
▶