PT-2017-12040
CVE-2017-11474
·
تاريخ النشر
2017-07-20
·
تاريخ التحديث
2018-02-24
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
GLPI versions prior to 9.1.5.1
Description
The issue concerns SQL Injection in the
crit variable within the inc/computer softwareversion.class.php file, which can be exploited through the ajax/common.tabs.php endpoint.Recommendations
For versions prior to 9.1.5.1, update to version 9.1.5.1 or later to resolve the issue.
As a temporary workaround, consider restricting access to the ajax/common.tabs.php endpoint until a patch is applied.
Avoid using the
crit variable in the affected API endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾