CVE-2023-46726

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.10

Description The issue is related to incorrect neutralization of special elements in output, which can allow a remote attacker to execute arbitrary code. The LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document on PHP 7.4 only.

Recommendations For versions 10.0.0 through 10.0.10, update to version 10.0.11 to resolve the issue. As a temporary workaround, consider restricting access to the LDAP server configuration form until the update is applied. Avoid using the LDAP server configuration form to upload or execute arbitrary code until the issue is resolved.