Vulnerability CVE-2023-51446: Information
Description
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
Severity: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Feb. 1, 2024
Modified: Feb. 7, 2024
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
---|---|---|---|---|---|---|
glpi | sisyphus | 10.0.12-alt1 | 10.0.15-alt1 | ALT-PU-2024-2541-1 | 340947 | Fixed |
glpi | sisyphus_e2k | 10.0.12-alt1 | 10.0.15-alt1 | ALT-PU-2024-2654-1 | - | Fixed |
glpi | sisyphus_loongarch64 | 10.0.12-alt1 | 10.0.15-alt1 | ALT-PU-2024-2569-1 | - | Fixed |
glpi | p10 | 10.0.12-alt1 | 10.0.15-alt1 | ALT-PU-2024-2543-2 | 340950 | Fixed |
glpi | p10_e2k | 10.0.12-alt1 | 10.0.15-alt1 | ALT-PU-2024-2788-1 | - | Fixed |
glpi | c10f1 | 10.0.15-alt1 | 10.0.15-alt1 | ALT-PU-2024-8030-2 | 348513 | Fixed |
glpi | p11 | 10.0.12-alt1 | 10.0.15-alt1 | ALT-PU-2024-2541-1 | 340947 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
---|---|
https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8 |
|
https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35 |
|
https://github.com/glpi-project/glpi/releases/tag/10.0.12 |
|