PT-2023-18551

CVE-2023-22500

Published

2023-01-25

Updated

2024-05-22

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.5

Description The issue allows unauthorized access to inventory files. If anonymous access to FAQ is allowed, inventory files become accessible by unauthenticated users.

Recommendations For GLPI versions 10.0.0 through 10.0.5, update to version 10.0.6 to resolve the issue. As a temporary workaround, consider disabling native inventory and delete inventory files from the server, specifically from the files/ inventory location.

Exploitability

Exploit

Fix

Impacts

Researchers

Cedric-Anne

Hightrasher

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers