PT-2023-4275 · Glpi+2 · Glpi+2

Flegastelois · Publicado 2023-07-05 · Atualizado 2024-08-22 · CVE-2023-35924

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.7

Description The issue is related to a SQL injection attack that can be driven through the GLPI inventory endpoint, which by default requires no authentication. This allows a remote attacker to execute arbitrary code. The estimated number of potentially affected devices is not specified.

Recommendations For versions 10.0.0 through 10.0.7, update to version 10.0.8 to resolve the issue. As a temporary workaround, consider disabling the native inventory endpoint until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

ALT-PU-2023-4552

ALT-PU-2023-7633

ALT-PU-2024-8030

BDU:2023-04593

CVE-2023-35924

GHSA-GXH4-J63W-8JMM

Produtos afetados

Alt Linux

Glpi

Red Os

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35924.json · Exploit
• https://github.com/glpi-project/glpi/releases/tag/10.0.8 · Nota
• https://github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm · Nota
• https://github.com/glpi-project/glpi/security/advisories/GHSA-gxh4-j63w-8jmm · Aviso do Fabricante
• https://safe-surf.ru/specialists/bulletins-nkcki/696240/?sphrase_id=45542 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-35924 · Aviso do Fabricante
• https://t.me/cibsecurity/66027 · Publicação no Telegram
• https://t.me/cvenotify/54025 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-04593 · Nota de Segurança
• https://t.me/avleonovcom/1425 · Publicação no Telegram
• https://cybersecurity-help.cz/vdb/SB2023071034 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-35924 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-35924 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-35924 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-35924 · Aviso do Fabricante