Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-39262

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.

Published

2022-11-03T14:15:12.013

Last Modified

2024-11-21T07:17:54.413

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.2 (MEDIUM)

Weaknesses

Type: Secondary
CWE-83
Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	glpi-project	glpi	< 10.0.4	Yes

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-4x48-q2wr-cpg4 Third Party Advisory ([email protected])
https://huntr.dev/bounties/54fc907e-6983-4c24-b249-1440aac1643c/ Exploit, Third Party Advisory ([email protected])
https://github.com/glpi-project/glpi/security/advisories/GHSA-4x48-q2wr-cpg4 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://huntr.dev/bounties/54fc907e-6983-4c24-b249-1440aac1643c/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)