CVE-2022-39277: Cross-Site Scripting (XSS) in external links in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to GLPI 10.0.4. There are currently no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is GLPI?
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package.
What is the vulnerability ID?
The vulnerability ID is CVE-2022-39277.
What is the severity of CVE-2022-39277?
The severity of CVE-2022-39277 is medium with a CVSS score of 4.8.
What is the CWE ID of CVE-2022-39277?
The CWE ID of CVE-2022-39277 is CWE-79 and CWE-80.
How does CVE-2022-39277 affect GLPI?
CVE-2022-39277 affects GLPI versions 0.60 to 10.0.4 by allowing Cross-Site Scripting (XSS) attacks through unsanitized external links.