CVE-2022-39262 - Stored Cross-Site Scripting (XSS) on login page in GLPI

Back Back to CVE browser

MEDIUM

Stored Cross-Site Scripting (XSS) on login page in GLPI

Published Nov 3, 2022

5.2

MEDIUM

CVSS 3.1

EPSS 0.68%

Description

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.

Affected products

Vendor Glpi-Project Product Glpi Default
n/a
- Version
  < 10.0.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Glpi-Project

Glpi

n/a

Version	Status	Constraints
< 10.0.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-83

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41772
Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-4x48-q2wr-cpg4
Third Party Advisory
https://huntr.dev/bounties/54fc907e-6983-4c24-b249-1440aac1643c/
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41772		Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-4x48-q2wr-cpg4		Third Party Advisory
https://huntr.dev/bounties/54fc907e-6983-4c24-b249-1440aac1643c/		ExploitThird Party Advisory