PT-2023-3267 · Glpi+2 · Glpi+2

Cedric-Anne + 1 · Published 2023-04-05 · Updated 2024-05-22 · CVE-2023-28636

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 0.60 through 9.5.12 GLPI versions 10.0.0 through 10.0.6

Description The issue is related to insufficient cleaning of user data when processing external links, allowing a user to inject and execute arbitrary HTML code and scripts in the user's browser within the context of the vulnerable website. This can enable a remote attacker to steal potentially confidential information, modify the appearance of web pages, and perform phishing and drive-by download attacks.

Recommendations For GLPI versions 0.60 through 9.5.12, update to version 9.5.13 to resolve the issue. For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-1801

ALT-PU-2023-1932

ALT-PU-2023-2081

ALT-PU-2023-5122

ALT-PU-2023-7633

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2023-03388

CVE-2023-28636

GHSA-55PM-MC2M-PQ46

Affected Products

Alt Linux

Glpi

Red Os

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28636.json · Exploit
• https://github.com/glpi-project/glpi/releases/tag/9.5.13 · Patch
• https://github.com/glpi-project/glpi/releases/tag/10.0.7 · Patch
• https://github.com/glpi-project/glpi/security/advisories/GHSA-55pm-mc2m-pq46 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-28636 · Security Note
• https://bdu.fstec.ru/vul/2023-03388 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28636 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28636 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28636 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28636 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Note