CVE-2023-46726 — Injection in Glpi

CWE-74 — Injection2 documents2 sources

Severity

9.8CRITICALNVD

EPSS

0.1%

top 68.82%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Glpi-project Glpi

Timeline

PublishedDec 13

Description

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDglpi-project/glpi10.0.0 — 10.0.11

▶CVEListV5glpi-project/glpi>= 10.0.0, < 10.0.11

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

CVE-2023-46726: GLPI is a free asset and IT management software package↗2023-12-13

▶