CVE-2022-34125

Name of the Vulnerable Software and Affected Versions GLPI CMDB plugin versions prior to 3.0.3

Description The issue allows attackers to gain read access to sensitive information via a log/ pathname in the file parameter. This is achieved by exploiting the front/icon.send.php file in the CMDB plugin for GLPI.

Recommendations For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the front/icon.send.php file to minimize the risk of exploitation. Avoid using the log/ pathname in the file parameter until the issue is resolved.