CVE-2022-24876: Stored cross site scrpting in GLPI's Kanban

Published Jun 9, 2022

Updated

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.

Affected Software

5 affected components

GLPI-PROJECT GLPI=10.0.0

GLPI-PROJECT GLPI=10.0.0-beta

GLPI-PROJECT GLPI=10.0.0-rc1

GLPI-PROJECT GLPI=10.0.0-rc2

GLPI-PROJECT GLPI=10.0.0-rc3

Remediation

Patch Available

https://github.com/glpi-project/glpi/commit/9a3c7487c8761eaa8f3b07589d6dcdfa5d1e4ed6

Event History

Jun 9, 2022

CVE Published

via MITRE·06:50 PM

Data Sourced

via MITRE·06:50 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-24876?

CVE-2022-24876 is classified as a medium severity vulnerability impacting certain versions of GLPI.

How do I fix CVE-2022-24876?

To fix CVE-2022-24876, upgrade GLPI to version 10.0.1 or later.

What types of systems are affected by CVE-2022-24876?

CVE-2022-24876 affects GLPI versions 10.0.0, including beta and release candidates.

What kind of vulnerability is CVE-2022-24876?

CVE-2022-24876 is a cross-site scripting (XSS) vulnerability.

Is there a known exploit for CVE-2022-24876?

Yes, CVE-2022-24876 can be exploited by a user to carry out malicious actions through XSS.