PT-2023-7946 · Php+3 · Php+3

Nikita Petrov · Publicado 2023-12-13 · Atualizado 2024-10-08 · CVE-2023-46726

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.10

Description The issue is related to incorrect neutralization of special elements in output, which can allow a remote attacker to execute arbitrary code. The LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document on PHP 7.4 only.

Recommendations For versions 10.0.0 through 10.0.10, update to version 10.0.11 to resolve the issue. As a temporary workaround, consider restricting access to the LDAP server configuration form until the update is applied. Avoid using the LDAP server configuration form to upload or execute arbitrary code until the issue is resolved.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

ALT-PU-2023-8061

ALT-PU-2023-8087

ALT-PU-2024-8030

BDU:2023-09030

CVE-2023-46726

GHSA-QC92-GXC6-5F95

Produtos afetados

Alt Linux

Glpi

Php

Red Os

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46726.json · Exploit
• https://github.com/glpi-project/glpi/commit/42ba2b031bec0b3889317db25f3adf9080fc11b2 · Correção
• https://github.com/glpi-project/glpi/security/advisories/GHSA-qc92-gxc6-5f95 · Nota
• https://github.com/glpi-project/glpi/releases/tag/10.0.11 · Nota
• https://cve.org/CVERecord?id=CVE-2023-46726 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-09030 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46726 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1735006289141584167 · Publicação no Twitter
• https://t.me/cvenotify/63983 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-46726 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1735050432106443085 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-46726 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-46726 · Aviso do Fabricante