PT-2022-20516 · Glpi · Glpi Inventory Plugin

Alexmothe93 · Published 2022-06-27 · Updated 2022-07-07 · CVE-2022-31082

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions glpi-inventory-plugin versions prior to 1.0.2

Description The issue concerns a SQL injection vulnerability in the glpi-inventory-plugin for GLPI, a free asset and IT management software package. This vulnerability can be exploited using package deployment tasks. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the use of the front/deploypackage.public.php file and the deploy tasks feature.

Recommendations For versions prior to 1.0.2, upgrade to version 1.0.2 to resolve the issue. As a temporary workaround for users unable to upgrade, delete the front/deploypackage.public.php file if the deploy tasks feature is not being used.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-31082

GHSA-Q6M7-H6RJ-5WMW

Affected Products

Glpi Inventory Plugin

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31082.json · Exploit
• https://github.com/glpi-project/glpi-inventory-plugin/commit/0b805ca6fb2a0f9bde4af29fca4f703fdfbd8f66 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31082 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31082 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31082 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31082 · Security Note
• https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q6m7-h6rj-5wmw · Note
• https://t.me/cvenotify/32263 · Telegram Post
• https://t.me/cibsecurity/45230 · Telegram Post