← CVE Intelligence

CVE-2022-39376

Improper input validation on emails links in GLPI PUBLISHED

Description (CNA)

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` links. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.

Affected (CNA)

Vendor / productVersions
glpi-project / glpiaffected >= 0.65, < 10.0.4

CWE

CWE-20

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.