CVE-2022-41941 — glpi contains XSS Stored inside Standard Interface Help Link href attribute

CVE-2022-41941

glpi contains XSS Stored inside Standard Interface Help Link href attribute PUBLISHED

Description (CNA)

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6.

Affected (CNA)

Vendor / product	Versions
glpi-project / glpi	affected >= 10.0.0, 10.0.6

CWE

CWE-79

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-qqqm-7h6v-7cf4

ADP enrichment

CVE

No English description supplied.

https://github.com/glpi-project/glpi/security/advisories/GHSA-qqqm-7h6v-7cf4

CISA-ADP

No English description supplied.

No references supplied.