PT-2023-3268 · Glpi+2 · Glpi+2

007Nicky · Published 2023-04-05 · Updated 2024-05-22 · CVE-2023-28852

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 9.5.0 through 9.5.12 GLPI versions 10.0.0 through 10.0.6

Description The issue is related to insufficient cleaning of user data in the administration panel, allowing a user to inject and execute arbitrary HTML and script code in the user's browser within the context of the vulnerable website. This can enable a remote attacker to steal potentially confidential information, modify the appearance of the web page, and perform phishing and drive-by download attacks.

Recommendations For GLPI versions 9.5.0 through 9.5.12, update to version 9.5.13 or later to resolve the issue. For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration panel to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-1801

ALT-PU-2023-1932

ALT-PU-2023-2081

ALT-PU-2023-5122

ALT-PU-2023-7633

ALT-PU-2024-8030

ALT-PU-2024-8094

BDU:2023-03389

CVE-2023-28852

GHSA-65GQ-P8HG-7M92

Affected Products

Alt Linux

Glpi

Red Os

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28852.json · Exploit
• https://github.com/glpi-project/glpi/releases/tag/9.5.13 · Patch
• https://github.com/glpi-project/glpi/releases/tag/10.0.7 · Patch
• https://github.com/glpi-project/glpi/security/advisories/GHSA-65gq-p8hg-7m92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28852 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28852 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28852 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-28852 · Security Note
• https://bdu.fstec.ru/vul/2023-03389 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28852 · Security Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023 · Note