PT-2023-3268 · Glpi+2 · Glpi+2

007Nicky · Publicado 2023-04-05 · Atualizado 2024-05-22 · CVE-2023-28852

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 9.5.0 through 9.5.12 GLPI versions 10.0.0 through 10.0.6

Description The issue is related to insufficient cleaning of user data in the administration panel, allowing a user to inject and execute arbitrary HTML and script code in the user's browser within the context of the vulnerable website. This can enable a remote attacker to steal potentially confidential information, modify the appearance of the web page, and perform phishing and drive-by download attacks.

Recommendations For GLPI versions 9.5.0 through 9.5.12, update to version 9.5.13 or later to resolve the issue. For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration panel to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2023-1801

ALT-PU-2023-1932

ALT-PU-2023-2081

ALT-PU-2023-5122

ALT-PU-2023-7633

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2023-03389

CVE-2023-28852

GHSA-65GQ-P8HG-7M92

Produtos afetados

Alt Linux

Glpi

Red Os

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28852.json · Exploit
• https://github.com/glpi-project/glpi/releases/tag/9.5.13 · Correção
• https://github.com/glpi-project/glpi/releases/tag/10.0.7 · Correção
• https://github.com/glpi-project/glpi/security/advisories/GHSA-65gq-p8hg-7m92 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-28852 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28852 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure · Nota
• https://ubuntu.com/security/CVE-2023-28852 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Nota
• https://cve.org/CVERecord?id=CVE-2023-28852 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03389 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-28852 · Nota de Segurança