PT-2019-12899 · Teclib · Glpi Teclib Fields Plugin

Publicado 2019-07-10 · Atualizado 2019-07-11 · CVE-2019-12723

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI Teclib Fields plugin versions through 1.9.2

Description The issue allows SQL Injection via the container id and old order parameters to the "ajax/reorder.php" endpoint by an unauthenticated user.

Recommendations For versions through 1.9.2, update to a version that contains a fix for this issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-12723

Produtos afetados

Glpi Teclib Fields Plugin

Referências · 5

• https://github.com/pluginsGLPI/fields/pull/317 · Nota
• https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php · Nota
• https://github.com/pluginsGLPI/fields/releases/tag/1.10.0 · Nota
• https://osv.dev/vulnerability/CVE-2019-12723 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12723 · Nota de Segurança