PT-2022-7409 · Glpi+2 · Glpi+2

Trasher · Published 2022-04-21 · Updated 2024-07-26 · CVE-2022-24867

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI (affected versions not specified)

Description The issue is related to an error in the configuration transfer to javascript in the GLPI system, where some entries are filtered out, but the ldap pass variable is not. This allows a remote attacker to gain unauthorized access to the root dn password. GLPI is a free asset and IT management software package that provides ITIL Service Desk features, licenses tracking, and software auditing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

ALT-PU-2022-1914

ALT-PU-2022-2614

ALT-PU-2022-2624

ALT-PU-2022-2665

ALT-PU-2023-7633

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2024-05821

CVE-2022-24867

GHSA-4R49-52Q9-5FGR

Affected Products

Alt Linux

Glpi

Red Os

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24867.json · Exploit
• 🔥 https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh · Exploit
• 🔥 https://github.com/Orange-Cyberdefense/CVE-repository · Exploit
• 🔥 https://github.com/cosad3s/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/cactuschibre/CVE-2022-35914-poc · Exploit
• 🔥 https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS · Exploit
• 🔥 https://github.com/Wangyanan131/CVE-2022-31061 · Exploit
• 🔥 https://github.com/Vu0r1-sec/CVE-2022-31061 · Exploit
• https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e · Patch
• https://osv.dev/vulnerability/CVE-2022-24867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24867 · Security Note
• https://bdu.fstec.ru/vul/2024-05821 · Security Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr · Note
• https://redos.red-soft.ru/support/secure · Note