PT-2023-3264 · Glpi+2 · Glpi+2

Alemmi · Published 2023-04-05 · Updated 2024-05-22 · CVE-2023-28639

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 0.85 through 9.5.12 GLPI versions 10.0.0 through 10.0.6

Description The issue is related to insufficient user data sanitization on search pages, allowing an attacker to craft a malicious link that can exploit a reflected XSS when opened by an authenticated user. This can lead to the execution of arbitrary HTML and script code in the user's browser, potentially allowing a remote attacker to steal confidential information, modify the webpage's appearance, or conduct phishing and drive-by download attacks.

Recommendations For GLPI versions 0.85 through 9.5.12, update to version 9.5.13 or later. For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-1801

ALT-PU-2023-1932

ALT-PU-2023-2081

ALT-PU-2023-5122

ALT-PU-2023-7633

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2023-03385

CVE-2023-28639

GHSA-R93Q-CHH5-JGH4

Affected Products

Alt Linux

Glpi

Red Os

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28639.json · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4 · Vendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/9.5.13 · Patch
• https://github.com/glpi-project/glpi/releases/tag/10.0.7 · Patch
• https://osv.dev/vulnerability/CVE-2023-28639 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28639 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03385 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28639 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-28639 · Security Note
• https://ubuntu.com/security/CVE-2023-28639 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Note