PT-2023-18551

CVE-2023-22500

Publicado

2023-01-25

Atualizado

2024-05-22

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.5

Description The issue allows unauthorized access to inventory files. If anonymous access to FAQ is allowed, inventory files become accessible by unauthenticated users.

Recommendations For GLPI versions 10.0.0 through 10.0.5, update to version 10.0.6 to resolve the issue. As a temporary workaround, consider disabling native inventory and delete inventory files from the server, specifically from the files/ inventory location.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Cedric-Anne

Hightrasher

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-863: Incorrect Authorization

Identificadores relacionados