PT-2023-4275 · Glpi+2 · Glpi+2

Flegastelois · Published 2023-07-05 · Updated 2024-08-22 · CVE-2023-35924

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.7

Description The issue is related to a SQL injection attack that can be driven through the GLPI inventory endpoint, which by default requires no authentication. This allows a remote attacker to execute arbitrary code. The estimated number of potentially affected devices is not specified.

Recommendations For versions 10.0.0 through 10.0.7, update to version 10.0.8 to resolve the issue. As a temporary workaround, consider disabling the native inventory endpoint until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2023-4552

ALT-PU-2023-7633

ALT-PU-2024-8030

BDU:2023-04593

CVE-2023-35924

GHSA-GXH4-J63W-8JMM

Affected Products

Alt Linux

Glpi

Red Os

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35924.json · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-gxh4-j63w-8jmm · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/696240/?sphrase_id=45542 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-35924 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04593 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-35924 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35924 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-35924 · Security Note
• https://ubuntu.com/security/CVE-2023-35924 · Vendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.8 · Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm · Note
• https://t.me/cibsecurity/66027 · Telegram Post
• https://t.me/cvenotify/54025 · Telegram Post
• https://t.me/avleonovcom/1425 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023071034 · Note