CVE-2022-35947: SQL injection in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the Enable login with external token API configuration.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-35947?
CVE-2022-35947 is a vulnerability in GLPI, a Free Asset and IT Management Software package, that allows for a SQL injection attack.
How severe is CVE-2022-35947?
CVE-2022-35947 has a severity rating of 9.8 out of 10, making it critical.
What is GLPI?
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package.
What is a SQL injection attack?
A SQL injection attack is a type of security vulnerability that allows an attacker to manipulate a database by injecting malicious SQL statements.
How can I fix CVE-2022-35947?
To fix CVE-2022-35947, you should update your GLPI software to version 10.0.4 or later, following the official patch provided by GLPI-PROJECT.