CVE-2022-36112

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.3

Description The issue is related to the usage of RSS feeds or external calendar in planning, which is subject to Server-Side Request Forgery (SSRF) exploit. This allows an attacker to scan server ports or services opened on the GLPI server or its private network. The queries' responses are not exposed to the end-user, making it a blind SSRF.

Recommendations For versions prior to 10.0.3, upgrade to version 10.0.3 to resolve this issue. At the moment, there are no known workarounds for this issue.