PT-2023-3267 · Glpi+2 · Glpi+2

Cedric-Anne + 1 · Publicado 2023-04-05 · Atualizado 2024-05-22 · CVE-2023-28636

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Média

Vetor base

AV:N/AC:L/Au:M/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 0.60 through 9.5.12 GLPI versions 10.0.0 through 10.0.6

Description The issue is related to insufficient cleaning of user data when processing external links, allowing a user to inject and execute arbitrary HTML code and scripts in the user's browser within the context of the vulnerable website. This can enable a remote attacker to steal potentially confidential information, modify the appearance of web pages, and perform phishing and drive-by download attacks.

Recommendations For GLPI versions 0.60 through 9.5.12, update to version 9.5.13 to resolve the issue. For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2023-1801

ALT-PU-2023-1932

ALT-PU-2023-2081

ALT-PU-2023-5122

ALT-PU-2023-7633

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2023-03388

CVE-2023-28636

GHSA-55PM-MC2M-PQ46

Produtos afetados

Alt Linux

Glpi

Red Os

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28636.json · Exploit
• https://github.com/glpi-project/glpi/releases/tag/9.5.13 · Correção
• https://github.com/glpi-project/glpi/releases/tag/10.0.7 · Correção
• https://github.com/glpi-project/glpi/security/advisories/GHSA-55pm-mc2m-pq46 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-28636 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03388 · Nota de Segurança
• https://redos.red-soft.ru/support/secure · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28636 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28636 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-28636 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28636 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Nota