CVE-2022-29250

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:glpi-project:glpi:10.0.0:-:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:10.0.0:beta:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:10.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:10.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:10.0.0:rc3:*:*:*:*:*:*

History

16 Jun 2022, 19:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : 4.0
v3 : 6.5
CPE cpe:2.3:a:glpi-project:glpi:10.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:10.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:10.0.0:-:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:10.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:10.0.0:beta:*:*:*:*:*:*
References (CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw - (CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw - Third Party Advisory

09 Jun 2022, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-06-09 20:15

Updated : 2024-02-04 22:29


NVD link : CVE-2022-29250

Mitre link : CVE-2022-29250

CVE.ORG link : CVE-2022-29250


JSON object : View

Products Affected

glpi-project

  • glpi
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')