← Voltar para CVEs
CVE-2023-42802
CRITICAL10.0
Descricao
GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.
Detalhes CVE
Pontuacao CVSS v3.110.0
SeveridadeCRITICAL
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosNONE
Interacao do usuarioNONE
Publicado11/2/2023
Ultima modificacao11/21/2024
Fontenvd
Avistamentos honeypot0
Produtos afetados
glpi-project:glpi
Fraquezas (CWE)
CWE-20CWE-434
Referencias
https://github.com/glpi-project/glpi/releases/tag/10.0.10(security-advisories@github.com)
https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3m(security-advisories@github.com)
https://github.com/glpi-project/glpi/releases/tag/10.0.10(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3m(af854a3a-2127-422b-91ae-364da2661108)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.