CVE-2022-31143: Leak of sensitive information through login page error in GLPI
First published: Wed Sep 14 2022(Updated: )
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of GLPI (like smtp or cas hosts). Note that passwords are not exposed. Users are advised to upgrade to version 10.0.3. There are no known workarounds for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GLPI | <10.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is GLPI?
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package.
What are the features provided by GLPI?
GLPI provides ITIL Service Desk features, licenses tracking, and software auditing.
What is the vulnerability ID?
The vulnerability ID is CVE-2022-31143.
What is the severity of CVE-2022-31143?
The severity of CVE-2022-31143 is medium with a CVSS score of 5.3.
What is the impact of CVE-2022-31143?
The impact of CVE-2022-31143 is an exposure of private information defined in the setup of GLPI.
What is the affected software version?
The affected software version is GLPI up to exclusive version 10.0.3.
How can I fix CVE-2022-31143?
To fix CVE-2022-31143, it is recommended to update GLPI to a version that includes the patch.
Where can I find more information about CVE-2022-31143?
More information about CVE-2022-31143 can be found at the following references: [GitHub Commit](https://github.com/glpi-project/glpi/commit/e66a0dfe697cbd4b3ec22736a8f8fd025a28f978) [GitHub Security Advisory](https://github.com/glpi-project/glpi/security/advisories/GHSA-6mmq-x3j2-677j)
What is the CWE ID of CVE-2022-31143?
The CWE ID of CVE-2022-31143 is 200.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/author
- agent/title
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/glpi-project
- canonical/glpi