Unauthenticated Local File Inclusion
CVE-2022-31062

5.3MEDIUM

Key Information:

Vendor
Glpi-project
Status
Glpi-inventory-plugin
Vendor
CVE Published:
20 June 2022

Summary

Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds b/deploy/index.php file can be deleted if deploy feature is not used.

Affected Version(s)

glpi-inventory-plugin < 1.0.2

References

https://github.com/glpi-project/glpi-inventory-plugin/sec...
http://packetstormsecurity.com/files/171654/GLPI-Glpiinve...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.