GLPI vulnerable to unallowed PHP script execution
CVE-2023-42802

10CRITICAL

Key Information:

Vendor
Glpi-project
Status
Glpi
Vendor
CVE Published:
2 November 2023

Summary

GLPI, a widely-used free asset and IT management software, has a vulnerability that allows an attacker to exploit unverified object instantiation. This flaw, present in versions 10.0.7 to 10.0.9, enables the upload of malicious PHP files to unintended directories, which may lead to the execution of these files via web server requests, depending on the server configuration and available libraries. Users are advised to upgrade to version 10.0.10, which addresses this issue. As an immediate mitigation, it is recommended to remove write access on the /ajax and /front directories for the web server.

Affected Version(s)

glpi >= 10.0.7, < 10.0.10

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM
https://github.com/glpi-project/glpi/releases/tag/10.0.10
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.