Vulnerability CVE-2023-22500: Information

Description

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by unauthenticated users. This issue is patched in version 10.0.6. As a workaround, disable native inventory and delete inventory files from server (default location is `files/_inventory`).

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-22500
Published: Jan. 27, 2023
Modified: Feb. 1, 2023
Error type identifier: CWE-863

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
glpisisyphus10.0.6-alt110.0.15-alt1ALT-PU-2023-1471-1316952Fixed
glpisisyphus_e2k10.0.6-alt110.0.15-alt1ALT-PU-2023-2895-1-Fixed
glpip1010.0.10-alt110.0.15-alt1ALT-PU-2023-7633-2335195Fixed
glpip10_e2k10.0.10-alt110.0.15-alt1ALT-PU-2023-7912-1-Fixed
glpic10f110.0.15-alt110.0.15-alt1ALT-PU-2024-8030-2348513Fixed
glpip1110.0.6-alt110.0.15-alt1ALT-PU-2023-1471-1316952Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://github.com/glpi-project/glpi/security/advisories/GHSA-3ghv-p34r-5ghx
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
      Start including
      10.0.0
      End excliding
      10.0.6
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top