XSS in Glpi-Project Glpi
CVE-2022-35945
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration page. They can be used to steal a GLPI administrator cookie. Users are advised to upgrade to 10.0.3. There are no known workarounds for this issue. ### Workarounds Do not use a registration key created by an untrusted person.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.007 (50.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.001
Affected products
- Glpi-Project Glpi — versions >= 9.5.0, < 10.0.3
Weakness classification (CWE)
References
- github.com/glpi-project/glpi/security/advisories/GHSA-jrgw-cx24-56x5 (Third Party Advisory)
- github.com/glpi-project/glpi/commit/2b8f9aa54ae4a4ec07bde0c8db739a292b8ec09a (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-35945?
- CVE-2022-35945 is a medium-severity vulnerability in Glpi-Project Glpi, classified under Cross-site Scripting. CVSS score: 6.3/10. Published 2022-09-14.
- How severe is CVE-2022-35945?
- Medium severity. CVSS v3 base score is 6.3 out of 10.