CVE-2022-39262
MEDIUM severity · CVSS 5.2 · CWE-83
5.2CVSS MEDIUM
Summary
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredHigh
User interactionRequired
Confidentiality impactHigh
Integrity impactNone
Availability impactLow
Exploit probability (EPSS)1%
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:L
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.