PT-2023-3264 · Glpi+2 · Glpi+2
Alemmi
·
Publicado
2023-04-05
·
Atualizado
2024-05-22
·
CVE-2023-28639
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
GLPI versions 0.85 through 9.5.12
GLPI versions 10.0.0 through 10.0.6
Description
The issue is related to insufficient user data sanitization on search pages, allowing an attacker to craft a malicious link that can exploit a reflected XSS when opened by an authenticated user. This can lead to the execution of arbitrary HTML and script code in the user's browser, potentially allowing a remote attacker to steal confidential information, modify the webpage's appearance, or conduct phishing and drive-by download attacks.
Recommendations
For GLPI versions 0.85 through 9.5.12, update to version 9.5.13 or later.
For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 or later.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Glpi
Red Os