CVE-2022-24867
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.31% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-522
- Affected
- glpi-project/glpi
- Source
- security-advisories@github.com
References
- https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94ePatch, Third Party Advisory
- https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgrThird Party Advisory
- https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94ePatch, Third Party Advisory
- https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgrThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.