CVE-2022-29250: SQL injection in GLPI

Published Jun 9, 2022

Updated

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.

Affected Software

5 affected components

GLPI-PROJECT GLPI=10.0.0

GLPI-PROJECT GLPI=10.0.0-beta

GLPI-PROJECT GLPI=10.0.0-rc1

GLPI-PROJECT GLPI=10.0.0-rc2

GLPI-PROJECT GLPI=10.0.0-rc3

Event History

Jun 9, 2022

CVE Published

via MITRE·07:55 PM

Data Sourced

via MITRE·07:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-29250?

CVE-2022-29250 is considered a high-severity vulnerability due to the potential for SQL injection attacks.

How do I fix CVE-2022-29250?

To remediate CVE-2022-29250, you should upgrade GLPI to version 10.0.1 or later.

Which versions of GLPI are affected by CVE-2022-29250?

CVE-2022-29250 affects GLPI versions prior to 10.0.1, specifically including 10.0.0 and its beta and release candidate versions.

What type of vulnerability is CVE-2022-29250?

CVE-2022-29250 is classified as an SQL injection vulnerability.

Can CVE-2022-29250 be exploited remotely?

Yes, CVE-2022-29250 can be exploited remotely through vulnerable search pages.