PT-2022-7402

CVE-2022-31187

Published

2022-09-14

Updated

2024-07-26

Description by

CVSS 3.1

6.8

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.3

Description The issue is related to the lack of neutralization of HTML tags during web page generation, which can allow a remote attacker to conduct a cross-site scripting attack. The affected versions do not properly neutralize HTML tags in the global search context.

Recommendations For versions prior to 10.0.3, upgrade to version 10.0.3 to resolve this issue. For users unable to upgrade, disable the global search as a temporary workaround.

Exploitability

Exploit

Fix

Impacts

Researchers

Edr4

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2022-31187