Attachment 250178 Details for Bug 278549 – correct false postivities for old GLPI versions

correct false postivities for old GLPI versions

patch_security_vuxml_vuln_2020-2023.xml (text/plain), 26.70 KB, created by Tomáš Čiernik on 2024-04-23 11:52:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomáš Čiernik

Created: 2024-04-23 11:52:38 UTC

Size: 26.70 KB

patch

obsolete

>diff --git a/security/vuxml/vuln/2020.xml b/security/vuxml/vuln/2020.xml
>index c91206e3c6..e8d2c9dea6 100644
>--- a/security/vuxml/vuln/2020.xml
>+++ b/security/vuxml/vuln/2020.xml
>@@ -386,7 +386,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.4.6</lt></range>
>+	<range><lt>9.4.6,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -413,7 +413,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.5.3</lt></range>
>+	<range><lt>9.5.3,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -439,7 +439,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.5.3</lt></range>
>+	<range><lt>9.5.3,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -465,8 +465,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>9.5.0</gt></range>
>-	<range><lt>9.5.3</lt></range>
>+	<range><ge>9.5.0,1</ge><lt>9.5.3,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -486,6 +485,7 @@
> <dates>
> <discovery>2020-10-01</discovery>
> <entry>2020-10-01</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -494,8 +494,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>9.1</gt></range>
>-	<range><lt>9.5.2</lt></range>
>+	<range><ge>9.1,1</ge><lt>9.5.2,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -514,6 +513,7 @@
> <dates>
> <discovery>2020-06-25</discovery>
> <entry>2020-06-25</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -522,8 +522,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>9.5.0</gt></range>
>-	<range><lt>9.5.2</lt></range>
>+	<range><ge>9.5.0,1</ge><lt>9.5.2,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -542,6 +541,7 @@
> <dates>
> <discovery>2020-06-25</discovery>
> <entry>2020-06-25</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -550,8 +550,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>0.65</gt></range>
>-	<range><lt>9.5.2</lt></range>
>+	<range><lt>9.5.2,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -570,6 +569,7 @@
> <dates>
> <discovery>2020-06-25</discovery>
> <entry>2020-06-25</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -578,8 +578,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>0.68</gt></range>
>-	<range><lt>9.5.2</lt></range>
>+	<range><lt>9.5.2,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -598,6 +597,7 @@
> <dates>
> <discovery>2020-06-25</discovery>
> <entry>2020-06-25</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -606,8 +606,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>0.70</gt></range>
>-	<range><lt>9.5.2</lt></range>
>+	<range><lt>9.5.2,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -626,6 +625,7 @@
> <dates>
> <discovery>2020-06-25</discovery>
> <entry>2020-06-25</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -634,8 +634,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>9.5.0</gt></range>
>-	<range><lt>9.5.1</lt></range>
>+	<range><ge>9.5.0,1</ge><lt>9.5.1,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -655,6 +654,7 @@
> <dates>
> <discovery>2020-06-25</discovery>
> <entry>2020-06-25</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -663,8 +663,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>0.68.1</gt></range>
>-	<range><lt>9.4.6</lt></range>
>+	<range><lt>9.4.6,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -683,6 +682,7 @@
> <dates>
> <discovery>2020-03-30</discovery>
> <entry>2020-03-30</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -691,7 +691,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.4.6</lt></range>
>+	<range><lt>9.4.6,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -718,7 +718,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.4.6</lt></range>
>+	<range><lt>9.4.6,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -746,8 +746,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>0.83.3</gt></range>
>-	<range><lt>9.4.6</lt></range>
>+	<range><ge>0.83.3,1</ge><lt>9.4.6,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -767,6 +766,7 @@
> <dates>
> <discovery>2020-03-30</discovery>
> <entry>2020-03-30</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -775,7 +775,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.4.6</lt></range>
>+	<range><lt>9.4.6,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -803,8 +803,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><gt>9.1</gt></range>
>-	<range><lt>9.4.6</lt></range>
>+	<range><ge>9.1,1</ge><lt>9.4.6,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -824,6 +823,7 @@
> <dates>
> <discovery>2020-03-30</discovery>
> <entry>2020-03-30</entry>
>+ <modified>2023-10-11</modified>
> </dates>
> </vuln>
> 
>@@ -832,7 +832,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.4.6</lt></range>
>+	<range><lt>9.4.6,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -858,7 +858,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.5.0</lt></range>
>+	<range><lt>9.5.0,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -886,7 +886,7 @@
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.4.4</lt></range>
>+	<range><lt>9.4.4,1</lt></range>
> </package>
> </affects>
> <description>
>@@ -9011,7 +9011,7 @@ Workaround:
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>9.4.3</lt></range>
>+	<range><lt>9.4.3,1</lt></range>
> </package>
> </affects>
> <description>
>diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
>index d9b02f61c7..82caef9941 100644
>--- a/security/vuxml/vuln/2023.xml
>+++ b/security/vuxml/vuln/2023.xml
>@@ -2493,6 +2493,561 @@ Reported by Niccolo Belli and WIPocket (Github #400, #417).
> </dates>
> </vuln>
> 
>+ <vuln vid="10e86b16-6836-11ee-b06f-0050569ceb3a">
>+ <topic>Unallowed PHP script execution in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	From the GLPI 10.0.10 Changelog:
>+	<blockquote
>+	cite="https://github.com/glpi-project/glpi/releases/tag/10.0.10">
>+	You will find below security issues fixed in this bugfixes version:
>+	[SECURITY - Critical] Unallowed PHP script execution (CVE-2023-42802).
>+	</blockquote>
>+	The mentioned CVE is invalid
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-42802</cvename>
>+ <url>https://github.com/glpi-project/glpi/releases/tag/10.0.10</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="894f2491-6834-11ee-b06f-0050569ceb3a">
>+ <topic>glpi-project -- SQL injection in ITIL actors in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>10.0.8,1</ge><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-x3jp-69f2-p84w">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. The ITIL
>+	actors input field from the Ticket form can be used to perform a
>+	SQL injection. Users are advised to upgrade to version 10.0.10.
>+	There are no known workarounds for this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-42461</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-42461</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="54e5573a-6834-11ee-b06f-0050569ceb3a">
>+ <topic>Phishing through a login page malicious URL in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>10.0.8,1</ge><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-2hcg-75jj-hghp">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. The lack
>+	of path filtering on the GLPI URL may allow an attacker to transmit
>+	a malicious URL of login page that can be used to attempt a phishing
>+	attack on user credentials. Users are advised to upgrade to version
>+	10.0.10. There are no known workarounds for this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-41888</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41888</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="20302cbc-6834-11ee-b06f-0050569ceb3a">
>+ <topic>Users login enumeration by unauthenticated user in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-5cf4-6q6r-49x9">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. An
>+	unauthenticated user can enumerate users logins. Users are advised
>+	to upgrade to version 10.0.10. There are no known workarounds for
>+	this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-41323</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41323</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="ae8b1445-6833-11ee-b06f-0050569ceb3a">
>+ <topic>Privilege Escalation from technician to super-admin in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.1.0,1</ge><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-9j8m-7563-8xvr">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. A user
>+	with write access to another user can make requests to change the
>+	latter&apos;s password and then take control of their account.
>+	Users are advised to upgrade to version 10.0.10. There are no known
>+	work around for this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-41322</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41322</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="6851f3bb-6833-11ee-b06f-0050569ceb3a">
>+ <topic>Sensitive fields enumeration through API in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.1.1,1</ge><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-3fxw-j5rj-w836">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. An API
>+	user can enumerate sensitive fields values on resources on which
>+	he has read access. Users are advised to upgrade to version 10.0.10.
>+	There are no known workarounds for this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-41321</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41321</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="df71f5aa-6831-11ee-b06f-0050569ceb3a">
>+ <topic>File deletion through document upload process in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>10.0.0,1</ge><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-hm76-jh96-7j75">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. The document
>+	upload process can be diverted to delete some files. Users are
>+	advised to upgrade to version 10.0.10. There are no known workarounds
>+	for this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-42462</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-42462</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="95c4ec45-6831-11ee-b06f-0050569ceb3a">
>+ <topic>Account takeover through API in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.3.0,1</ge><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-58wj-8jhx-jpm3">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. An API
>+	user that have read access on users resource can steal accounts of
>+	other users. Users are advised to upgrade to version 10.0.10.
>+	There are no known workarounds for this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-41324</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41324</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="040e69f1-6831-11ee-b06f-0050569ceb3a">
>+ <topic>Account takeover via Kanban feature in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.5.0,1</ge><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-5wj6-hp4c-j5q9">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. A logged
>+	user from any profile can hijack the Kanban feature to alter any
>+	user field, and end-up with stealing its account. Users are advised
>+	to upgrade to version 10.0.10. There are no known workarounds for
>+	this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-41326</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41326</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="6f6518ab-6830-11ee-b06f-0050569ceb3a">
>+ <topic>Account takeover via SQL Injection in UI layout preferences in GLPI</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>10.0.0,1</ge><lt>10.0.10,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/security/advisories/GHSA-mv2r-gpw3-g476">
>+	 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free
>+	Asset and IT Management Software package, that provides ITIL Service
>+	Desk features, licenses tracking and software auditing. UI layout
>+	preferences management can be hijacked to lead to SQL injection.
>+	This injection can be use to takeover an administrator account.
>+	Users are advised to upgrade to version 10.0.10. There are no known
>+	workarounds for this vulnerability.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-41320</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-41320</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-09-27</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="257e1bf0-682f-11ee-b06f-0050569ceb3a">
>+ <topic>GLPI vulnerable to SQL injection via dashboard administration</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.5.0,1</ge><lt>10.0.9,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.9">
>+	 GLPI is a Free Asset and IT Management Software package, Data center
>+	management, ITIL Service Desk, licenses tracking and software
>+	auditing. An administrator can trigger SQL injection via dashboards
>+	administration. This vulnerability has been patched in version
>+	10.0.9.
>+	
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-37278</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-37278</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-07-13</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="40173815-6827-11ee-b06f-0050569ceb3a">
>+ <topic>GLPI vulnerable to unauthorized access to User data</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><lt>10.0.8,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
>+	 GLPI is a free asset and IT management software package. Versions
>+	of the software starting with 0.68 and prior to 10.0.8 have an
>+	incorrect rights check on a on a file accessible by an authenticated
>+	user. This allows access to the list of all users and their personal
>+	information. Users should upgrade to version 10.0.8 to receive a
>+	patch.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-34106</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-34106</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-07-05</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="1fe40200-6823-11ee-b06f-0050569ceb3a">
>+ <topic>GLPI vulnerable to unauthorized access to KnowbaseItem data</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.2.0,1</ge><lt>10.0.8,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
>+	 GLPI is a free asset and IT management software package. Versions
>+	of the software starting with 9.2.0 and prior to 10.0.8 have an
>+	incorrect rights check on a on a file accessible by an authenticated
>+	user, allows access to the view all KnowbaseItems. Version 10.0.8
>+	has a patch for this issue.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-34107</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-34107</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-07-05</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="b14a6ddc-6821-11ee-b06f-0050569ceb3a">
>+ <topic>GLPI vulnerable to reflected XSS in search pages</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.4.0,1</ge><lt>10.0.8,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
>+	 GLPI is a free asset and IT management software package. Starting
>+	in version 9.4.0 and prior to version 10.0.8, a malicious link can
>+	be crafted by an unauthenticated user that can exploit a reflected
>+	XSS in case any authenticated user opens the crafted link. Users
>+	should upgrade to version 10.0.8 to receive a patch.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-34244</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-34244</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-07-05</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="95fde6bc-6821-11ee-b06f-0050569ceb3a">
>+ <topic>GLPI vulnerable to unauthenticated access to Dashboard data</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.5.0,1</ge><lt>10.0.8,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
>+	 GLPI is a free asset and IT management software package. Starting
>+	in version 9.5.0 and prior to version 10.0.8, an incorrect rights
>+	check on a file allows an unauthenticated user to be able to access
>+	dashboards data. Version 10.0.8 contains a patch for this issue.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-35940</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-35940</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-07-05</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="717efd8a-6821-11ee-b06f-0050569ceb3a">
>+ <topic>GLPI vulnerable to unauthorized access to Dashboard data</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>9.5.0,1</ge><lt>10.0.8,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
>+	 GLPI is a free asset and IT management software package. Starting
>+	in version 9.5.0 and prior to version 10.0.8, an incorrect rights
>+	check on a on a file accessible by an authenticated user (or not
>+	for certain actions), allows a threat actor to interact, modify,
>+	or see Dashboard data. Version 10.0.8 contains a patch for this
>+	issue.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-35939</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-35939</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-07-05</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="548a4163-6821-11ee-b06f-0050569ceb3a">
>+ <topic>GLPI vulnerable to SQL injection through Computer Virtual Machine information</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><lt>10.0.8,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
>+	 GLPI is a free asset and IT management software package. Starting
>+	in version 0.80 and prior to version 10.0.8, Computer Virtual Machine
>+	form and GLPI inventory request can be used to perform a SQL injection
>+	attack. Version 10.0.8 has a patch for this issue. As a workaround,
>+	one may disable native inventory.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-36808</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-36808</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-07-05</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="e44e5ace-6820-11ee-b06f-0050569ceb3a">
>+ <topic>GLPI vulnerable to SQL injection via inventory agent request</topic>
>+ <affects>
>+ <package>
>+	<name>glpi</name>
>+	<range><ge>10.0.0,1</ge><lt>10.0.8,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+	<body xmlns="http://www.w3.org/1999/xhtml">
>+	security-advisories@github.com reports:
>+	<blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.8">
>+	 GLPI is a free asset and IT management software package. Starting
>+	in version 10.0.0 and prior to version 10.0.8, GLPI inventory
>+	endpoint can be used to drive a SQL injection attack. By default,
>+	GLPI inventory endpoint requires no authentication. Version 10.0.8
>+	has a patch for this issue. As a workaround, one may disable native
>+	inventory.
>+	</blockquote>
>+	</body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2023-35924</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-35924</url>
>+ </references>
>+ <dates>
>+ <discovery>2023-07-05</discovery>
>+ <entry>2023-10-11</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="4f254817-6318-11ee-b2ff-080027de9982">
> <topic>Django -- multiple vulnerabilities</topic>
> <affects>
>@@ -8265,7 +8820,7 @@ Reported by Niccolo Belli and WIPocket (Github #400, #417).
> <affects>
> <package>
> 	<name>glpi</name>
>-	<range><lt>10.0.7</lt></range>
>+	<range><lt>10.0.7,1</lt></range>
> </package>
> </affects>
> <description>

Actions: View

Attachments on bug 278549: 250178 | 250221