CVE-2022-35946

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.3

Description The issue is related to improper validation of request input in the plugin controller, allowing access to the low-level API of the Plugin class. This can be exploited by an attacker to alter database data. The attacker must have "General setup" update rights to perform this attack.

Recommendations For versions prior to 10.0.3, upgrade to version 10.0.3 to resolve the issue. For users unable to upgrade, remove the front/plugin.form.php script as a temporary workaround.