CVE-2023-28639

Name of the Vulnerable Software and Affected Versions GLPI versions 0.85 through 9.5.12 GLPI versions 10.0.0 through 10.0.6

Description The issue is related to insufficient user data sanitization on search pages, allowing an attacker to craft a malicious link that can exploit a reflected XSS when opened by an authenticated user. This can lead to the execution of arbitrary HTML and script code in the user's browser, potentially allowing a remote attacker to steal confidential information, modify the webpage's appearance, or conduct phishing and drive-by download attacks.

Recommendations For GLPI versions 0.85 through 9.5.12, update to version 9.5.13 or later. For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 or later.