CVE-2022-24876

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/glpi-project/glpi/commit/9a3c7487c8761eaa8f3b07589d6dcdfa5d1e4ed6	Patch Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-33g2-m556-gccr	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:glpi-project:glpi:10.0.0:-::::::
	cpe:2.3:a:glpi-project:glpi:10.0.0:beta::::::
	cpe:2.3:a:glpi-project:glpi:10.0.0:rc1::::::
	cpe:2.3:a:glpi-project:glpi:10.0.0:rc2::::::
	cpe:2.3:a:glpi-project:glpi:10.0.0:rc3::::::

History

No history.

Information

Published : 2022-06-09 19:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-24876

Mitre link : CVE-2022-24876

CVE.ORG link : CVE-2022-24876

JSON object : View

Products Affected

glpi-project

glpi

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-24876", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-06-09T19:15:09.587", "references": [{"url": "https://github.com/glpi-project/glpi/commit/9a3c7487c8761eaa8f3b07589d6dcdfa5d1e4ed6", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-33g2-m556-gccr", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue."}, {"lang": "es", "value": "GLPI es un paquete gratuito de software de administraci\u00f3n de activos y TI, que proporciona funciones de Service Desk de ITIL, seguimiento de licencias y auditor\u00eda de software. Kanban es una visualizaci\u00f3n de GLPI para mostrar Proyectos, Tickets, Cambios o Problemas en un tablero de tareas. En las versiones anteriores a 10.0.1 un usuario puede explotar una vulnerabilidad de tipo cross site scripting en Kanban al inyectar c\u00f3digo HTML en su nombre de usuario. Es recomendado a usuarios actualizar. No se presentan mitigaciones conocidas para este problema"}], "lastModified": "2022-06-17T19:22:07.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:10.0.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6C1760F-4B01-4775-8481-D93BA28888BF"}, {"criteria": "cpe:2.3:a:glpi-project:glpi:10.0.0:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0378AD5-BFA0-40CD-BFB5-9D9E0790E9B7"}, {"criteria": "cpe:2.3:a:glpi-project:glpi:10.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E82A2E80-7C91-4147-A951-CA25E3AA1F01"}, {"criteria": "cpe:2.3:a:glpi-project:glpi:10.0.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16485B8E-5550-433C-A352-BABBC22DF375"}, {"criteria": "cpe:2.3:a:glpi-project:glpi:10.0.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "076C11C8-A848-43FB-8C01-E68D85015C58"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}