PT-2022-1461 · Glpi+2 · Glpi+2

Janosvaszi + 1 · Published 2022-01-27 · Updated 2024-05-22 · CVE-2022-21719

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.5.7

Description The issue is related to reflected cross-site scripting in GLPI, a free asset and IT management software package. This can allow a remote attacker to perform cross-site scripting attacks by exploiting the lack of protection measures for the web page structure. There are no known workarounds for this issue.

Recommendations For versions prior to 9.5.7, update to version 9.5.7 to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages or modules until the patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2022-1463

ALT-PU-2022-1514

ALT-PU-2022-1526

ALT-PU-2022-2614

ALT-PU-2022-2624

ALT-PU-2022-2665

ALT-PU-2023-7633

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2022-00590

CVE-2022-21719

GHSA-6CJ4-G839-GJ5J

Affected Products

Alt Linux

Glpi

Red Os

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21719.json · Exploit
• 🔥 https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh · Exploit
• 🔥 https://github.com/Orange-Cyberdefense/CVE-repository · Exploit
• 🔥 https://github.com/cactuschibre/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/cosad3s/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS · Exploit
• 🔥 https://github.com/Wangyanan131/CVE-2022-31061 · Exploit
• 🔥 https://github.com/Vu0r1-sec/CVE-2022-31061 · Exploit
• https://github.com/glpi-project/glpi/commit/e9b16bc8e9b61ebb2d35b96b9c71cd25c5af9e48 · Patch
• https://cve.org/CVERecord?id=CVE-2022-21719 · Security Note
• https://bdu.fstec.ru/vul/2022-00590 · Security Note
• https://ubuntu.com/security/CVE-2022-21719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21719 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21719 · Vendor Advisory