← CVE Intelligence

CVE-2022-39323

SQL Injection on REST API in GLPI PUBLISHED

Description (CNA)

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST user_token. This issue has been patched, please upgrade to version 10.0.4. As a workaround, disable login with user_token on API Rest.

Affected (CNA)

Vendor / productVersions
glpi-project / glpiaffected < 10.0.4

CWE

CWE-89

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.