PT-2023-18551 · Glpi+1 · Glpi+1

Cedric-Anne + 1 · Published 2023-01-25 · Updated 2024-05-22 · CVE-2023-22500

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.5

Description The issue allows unauthorized access to inventory files. If anonymous access to FAQ is allowed, inventory files become accessible by unauthenticated users.

Recommendations For GLPI versions 10.0.0 through 10.0.5, update to version 10.0.6 to resolve the issue. As a temporary workaround, consider disabling native inventory and delete inventory files from the server, specifically from the files/ inventory location.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2023-1471

ALT-PU-2023-7633

ALT-PU-2024-8030

CVE-2023-22500

GHSA-3GHV-P34R-5GHX

Affected Products

Alt Linux

Glpi

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22500.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-22500 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-22500 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22500 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22500 · Vendor Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-3ghv-p34r-5ghx · Note