CVE-2023-42802

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.7 through 10.0.9

Description GLPI is a free asset and IT management software package. An unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request.

Recommendations For versions 10.0.7 through 10.0.9, update to version 10.0.10 to fix the issue. As a temporary workaround, remove write access on /ajax and /front files to the web server.