Vulnerability in N/a
CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
EPSS: 0.944 (100.0th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- www.bioinformatics.org/phplabware/sourceer/sourceer.php
- github.com/glpi-project/glpi/releases
- glpi-project.org/fr/glpi-10-0-3-disponible/
- packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
- github.com/Orange-Cyberdefense/CVE-repository/
- github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh
- mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/
Frequently asked questions
- What is CVE-2022-35914?
- CVE-2022-35914 is a vulnerability in N/a. Published 2022-09-19.
- Is CVE-2022-35914 known to be exploited?
- Yes. CVE-2022-35914 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-03-07), indicating it is being actively exploited. 64 public proof-of-concept repositories are indexed.