CVE-2022-24869

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.0

Description The issue is related to the use of ticket followups or setup login messages with a stylesheet link in GLPI, which may allow for a cross-site scripting attack vector. This is partially mitigated by the CORS security of browsers. Users are still advised to upgrade.

Recommendations For versions prior to 10.0.0, upgrade to version 10.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of stylesheet links in ticket followups or setup login messages until a patch is available. Restrict access to the vulnerable features to minimize the risk of exploitation.