CVE-2022-31061: SQL injection on login page in GLPI

Q: What is the severity of CVE-2022-31061?

CVE-2022-31061 is categorized as a high severity SQL injection vulnerability.

Q: How do I fix CVE-2022-31061?

To fix CVE-2022-31061, upgrade to GLPI version 10.0.3 or later.

Q: What versions of GLPI are affected by CVE-2022-31061?

CVE-2022-31061 affects GLPI versions from 9.3.0 to 9.5.8 and 10.0.0 to 10.0.2.

Q: Can CVE-2022-31061 be exploited without user credentials?

Yes, CVE-2022-31061 can be exploited on the login page without needing user credentials.

Q: What type of vulnerability is CVE-2022-31061?

CVE-2022-31061 is a SQL injection vulnerability in the GLPI software.

Published Jun 28, 2022

Updated

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Affected Software

2 affected components

GLPI-PROJECT GLPI>=9.3.0<9.5.8

GLPI-PROJECT GLPI>=10.0.0<10.0.2

Remediation

Patch Available

https://github.com/glpi-project/glpi/commit/21ae07d00d0b3230f6235386e98388cfc5bb0514

Event History

Jun 28, 2022

CVE Published

via MITRE·05:55 PM

Data Sourced

via MITRE·05:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-31061?

CVE-2022-31061 is categorized as a high severity SQL injection vulnerability.

How do I fix CVE-2022-31061?