What is CVE-2022-29250?

CVE-2022-29250 is a high-severity vulnerability in Glpi-Project Glpi, classified under SQL Injection. CVSS score: 8.1/10. Published 2022-06-09.

How severe is CVE-2022-29250?

High severity. CVSS v3 base score is 8.1 out of 10.

SQL Injection in Glpi-Project Glpi

CVE-2022-29250

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.

Vulnerability class: SQL Injection

EPSS: 0.007 (51.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Glpi-project Glpi — versions 10.0.0, < 10.0.1

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2022-29250?: CVE-2022-29250 is a high-severity vulnerability in Glpi-Project Glpi, classified under SQL Injection. CVSS score: 8.1/10. Published 2022-06-09.
How severe is CVE-2022-29250?: High severity. CVSS v3 base score is 8.1 out of 10.