PT-2023-28588 · Glpi+1 · Glpi+1

Mmnhack · Publicado 2023-10-07 · Atualizado 2024-05-22 · CVE-2023-42802

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.7 through 10.0.9

Description GLPI is a free asset and IT management software package. An unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request.

Recommendations For versions 10.0.7 through 10.0.9, update to version 10.0.10 to fix the issue. As a temporary workaround, remove write access on /ajax and /front files to the web server.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-20

CWE-434

Identificadores relacionados

ALT-PU-2023-6186

ALT-PU-2023-7633

ALT-PU-2024-8030

CVE-2023-42802

GHSA-RRH2-X4CH-PQ3M

Produtos afetados

Alt Linux

Glpi

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42802.json · Exploit
• https://github.com/glpi-project/glpi/releases/tag/10.0.10 · Nota
• https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3m · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-42802 · Aviso do Fabricante
• https://twitter.com/cracbot/status/1720381884977262954 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2023-42802 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1720143647297904680 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1720076552376046008 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-42802 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42802 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-42802 · Nota de Segurança