CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff	Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:45

Type	Values Removed	Values Added
References	~~() https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff - Third Party Advisory~~	() https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~4.8~~	v2 : unknown v3 : 6.2
Summary		(es) GLPI es un paquete gratuito de software de gestión de TI y activos. Las versiones anteriores a la 10.0.6 están sujetas a cross-site scripting a través de canales RSS maliciosos. Un administrador puede importar una fuente RSS maliciosa que contenga payloads de Cross Site Scripting (XSS) dentro de enlaces RSS. Las víctimas que deseen visitar un contenido RSS y hacer clic en el enlace ejecutarán el Javascript. Este problema se solucionó en 10.0.6.

Information

Published : 2023-01-26 21:18

Updated : 2024-11-21 07:45

NVD link : CVE-2023-22724

Mitre link : CVE-2023-22724

CVE.ORG link : CVE-2023-22724

JSON object : View

Products Affected

glpi-project

glpi

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-22724", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2023-01-26T21:18:12.770", "references": [{"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.\n"}, {"lang": "es", "value": "GLPI es un paquete gratuito de software de gesti\u00f3n de TI y activos. Las versiones anteriores a la 10.0.6 est\u00e1n sujetas a cross-site scripting a trav\u00e9s de canales RSS maliciosos. Un administrador puede importar una fuente RSS maliciosa que contenga payloads de Cross Site Scripting (XSS) dentro de enlaces RSS. Las v\u00edctimas que deseen visitar un contenido RSS y hacer clic en el enlace ejecutar\u00e1n el Javascript. Este problema se solucion\u00f3 en 10.0.6."}], "lastModified": "2024-11-21T07:45:17.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B025E2D5-B467-460F-A5B0-053D46B581E6", "versionEndExcluding": "10.0.6", "versionStartIncluding": "10.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}