CVE-2022-24876 - Stored cross site scrpting in GLPI's Kanban

Back Back to CVE browser

MEDIUM

Stored cross site scrpting in GLPI's Kanban

Published Jun 9, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.52%

Description

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

Vendor Glpi-Project Product Glpi Default
n/a
- Version
  < 10.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Glpi-Project

Glpi

n/a

Version	Status	Constraints
< 10.0.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29649
Advisory
https://github.com/glpi-project/glpi/commit/9a3c7487c8761eaa8f3b07589d6dcdfa5d1e4ed6
x_refsource_MISCPatchThird Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-33g2-m556-gccr
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29649		Advisory
https://github.com/glpi-project/glpi/commit/9a3c7487c8761eaa8f3b07589d6dcdfa5d1e4ed6		x_refsource_MISCPatchThird Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-33g2-m556-gccr		x_refsource_CONFIRMThird Party Advisory