CVE-2023-28852

Summary

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

Impact & exploitability

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products we track (1)

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://github.com/glpi-project/glpi/releases/tag/10.0.7 ↗

Additional information

• NVD record
• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch
• https://github.com/glpi-project/glpi/security/advisories/GHSA-65gq-p8hg-7m92Advisory