Vulnerability CVE-2022-31056: Information
Description
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.
Severity: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
---|---|---|---|---|---|---|
glpi | sisyphus | 10.0.2-alt1 | 10.0.15-alt1 | ALT-PU-2022-2291-1 | 304144 | Fixed |
glpi | sisyphus_e2k | 10.0.2-alt1 | 10.0.15-alt1 | ALT-PU-2022-5608-1 | - | Fixed |
glpi | p10 | 10.0.10-alt1 | 10.0.15-alt1 | ALT-PU-2023-7633-2 | 335195 | Fixed |
glpi | p10_e2k | 10.0.10-alt1 | 10.0.15-alt1 | ALT-PU-2023-7912-1 | - | Fixed |
glpi | c10f1 | 10.0.15-alt1 | 10.0.15-alt1 | ALT-PU-2024-8030-2 | 348513 | Fixed |
glpi | p11 | 10.0.2-alt1 | 10.0.15-alt1 | ALT-PU-2022-2291-1 | 304144 | Fixed |