← Retour aux CVEs

CVE-2023-46726

HIGH

7.2

Description

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue.

Details CVE

Score CVSS v3.17.2

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisHIGH

Interaction utilisateurNONE

Publie12/13/2023

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

glpi-project:glpi

Faiblesses (CWE)

CWE-74

References

https://github.com/glpi-project/glpi/commit/42ba2b031bec0b3889317db25f3adf9080fc11b2(security-advisories@github.com)

https://github.com/glpi-project/glpi/releases/tag/10.0.11(security-advisories@github.com)

https://github.com/glpi-project/glpi/security/advisories/GHSA-qc92-gxc6-5f95(security-advisories@github.com)

https://github.com/glpi-project/glpi/commit/42ba2b031bec0b3889317db25f3adf9080fc11b2(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/glpi-project/glpi/releases/tag/10.0.11(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/glpi-project/glpi/security/advisories/GHSA-qc92-gxc6-5f95(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.