CVE-2023-42802 | GLPI is a free asset and IT management software package. Sta… | CVSS 10.0 CRITICAL

Description

GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.

Metadata

CVE ID: CVE-2023-42802
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2023-09-14 16:13 UTC
Published: 2023-11-02 13:32 UTC
Last updated: 2024-09-05 15:16 UTC
Primary CWE: CWE-20
CWE-20: Improper Input Validation
Vendor / Product: glpi-project / glpi
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
glpi-project	glpi	—	>= 10.0.7, < 10.0.10

Weakness (CWE)

CWE	Source	Description
CWE-20	cna	CWE-20: Improper Input Validation

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3m https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3m
https://github.com/glpi-project/glpi/releases/tag/10.0.10 https://github.com/glpi-project/glpi/releases/tag/10.0.10