CVE-2023-51446

GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

07 Feb 2024, 20:59

Type Values Removed Values Added
First Time Glpi-project
Glpi-project glpi
CPE cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 5.9
v2 : unknown
v3 : 8.1
References () https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35 - () https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35 - Patch
References () https://github.com/glpi-project/glpi/releases/tag/10.0.12 - () https://github.com/glpi-project/glpi/releases/tag/10.0.12 - Patch, Release Notes
References () https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8 - () https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8 - Vendor Advisory

01 Feb 2024, 18:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-01 18:15

Updated : 2024-02-07 20:59


NVD link : CVE-2023-51446

Mitre link : CVE-2023-51446

CVE.ORG link : CVE-2023-51446


JSON object : View

Products Affected

glpi-project

  • glpi
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')