CVE-2023-22722: glpi subject to Cross-site Scripting (XSS) - Reflected
GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the victim or exfiltrate session cookies. This issue is patched in version 10.0.6.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-22722?
CVE-2023-22722 is a vulnerability in GLPI, a Free Asset and IT Management Software package, that allows an attacker to perform cross-site scripting (XSS) attacks by persuading a victim to open a URL containing malicious code.
How does CVE-2023-22722 work?
CVE-2023-22722 works by exploiting a vulnerability in GLPI versions 9.4.0 and above, prior to 10.0.6, which allows an attacker to inject malicious code into the victim's browser when they open a specially crafted URL.
What is the severity of CVE-2023-22722?
The severity of CVE-2023-22722 is medium with a CVSS score of 6.1.
How can I fix CVE-2023-22722?
To fix CVE-2023-22722, it is recommended to upgrade GLPI to version 10.0.6 or above.
Where can I find more information about CVE-2023-22722?
More information about CVE-2023-22722 can be found in the official GitHub security advisory of GLPI.