PT-2022-7393

CVE-2022-39372

Published

2022-09-15

Updated

2024-07-26

Description by

CVSS 2.0

5.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.4

Description The issue allows authenticated users to store malicious code in their account information, potentially leading to a cross-site scripting (XSS) attack. This could enable a remote attacker to conduct such an attack by exploiting the lack of protection measures for the web page structure.

Recommendations For versions prior to 10.0.4, upgrade to version 10.0.4 to resolve the issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploitability

Exploit

Fix

Impacts

Researchers

Trasher

Vendors

Affected products

Weakness enumeration

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers