PT-2022-7410 · Unknown+1 · Glpi Reports Plugin+1

Published 2022-11-17 · Updated 2024-07-29 · CVE-2022-39181

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GLPI reports plugin (affected versions not specified)

Description The issue is related to the incorrect neutralization of input data during web page generation, allowing a remote attacker to conduct Cross-Site-Scripting (XSS) attacks via a specially crafted website. This is a Reflected Cross-Site-Scripting (RXSS) vulnerability, where the server reads data directly from the HTTP request and reflects it back in the HTTP response. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or emailed directly to the victim.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-05822

CVE-2022-39181

Affected Products

Glpi Reports Plugin

Red Os

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-39181 · Security Note
• https://bdu.fstec.ru/vul/2024-05822 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39181 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvenotify/38320 · Telegram Post
• https://gov.il/en/Departments/faq/cve_advisories · Note
• https://t.me/cibsecurity/53136 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-plugin-reports-cve-2022-39181 · Note