PT-2023-6848 · Glpi+2 · Glpi+2

Cedric-Anne · Publicado 2023-09-26 · Atualizado 2024-05-22 · CVE-2023-42462

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.10

Description The issue is related to an unlimited file upload vulnerability in the GLPI system, which can be exploited by a remote attacker to upload arbitrary files to the system. This can potentially allow the deletion of some files by diverting the document upload process. The GLPI system is a free asset and IT management software package that provides ITIL Service Desk features, licenses tracking, and software auditing.

Recommendations For versions prior to 10.0.10, upgrade to version 10.0.10 to resolve the issue. As a temporary workaround, consider restricting access to the file upload functionality until the upgrade is applied. Avoid using the file upload feature in the affected system until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Path traversal

Enumeração de Fraquezas

CWE-434

CWE-22

Identificadores relacionados

ALT-PU-2023-6186

ALT-PU-2023-7633

ALT-PU-2024-8030

BDU:2023-07851

CVE-2023-42462

GHSA-HM76-JH96-7J75

Produtos afetados

Alt Linux

Glpi

Red Os

Referências · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42462.json · Exploit
• 🔥 https://github.com/cactuschibre/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/cosad3s/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/Wangyanan131/CVE-2022-31061 · Exploit
• 🔥 https://github.com/Vu0r1-sec/CVE-2022-31061 · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-hm76-jh96-7j75 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-42462 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1706851417347010727 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2023-42462 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42462 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1707088086365086208 · Publicação no Twitter
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-41320-cve-2023-41321-cve-2023-41322-cve-2023-41323-cve-2023 · Nota
• https://cve.org/CVERecord?id=CVE-2023-42462 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-42462 · Nota de Segurança