What is CVE-2023-22722?

CVE-2023-22722 is a vulnerability in GLPI, a Free Asset and IT Management Software package, that allows an attacker to perform cross-site scripting (XSS) attacks by persuading a victim to open a URL containing malicious code.

How does CVE-2023-22722 work?

CVE-2023-22722 works by exploiting a vulnerability in GLPI versions 9.4.0 and above, prior to 10.0.6, which allows an attacker to inject malicious code into the victim's browser when they open a specially crafted URL.

What is the severity of CVE-2023-22722?

The severity of CVE-2023-22722 is medium with a CVSS score of 6.1.

How can I fix CVE-2023-22722?

To fix CVE-2023-22722, it is recommended to upgrade GLPI to version 10.0.6 or above.

Where can I find more information about CVE-2023-22722?

More information about CVE-2023-22722 can be found in the official GitHub security advisory of GLPI.

Vulnerability/
CVE-2023-22722

medium

6.8

CWE

25/1/2023

2/8/2024

CVE-2023-22722: glpi subject to Cross-site Scripting (XSS) - Reflected

First published: Wed Jan 25 2023(Updated: )

GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the victim or exfiltrate session cookies. This issue is patched in version 10.0.6.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
GLPI-PROJECT GLPI	>=9.4.0<9.5.12
GLPI-PROJECT GLPI	>=10.0.0<10.0.6

Never miss a vulnerability like this again

Reference Links

https://github.com/glpi-project/glpi/security/advisories/GHSA-352j-wr38-493c

Frequently Asked Questions

What is CVE-2023-22722?
CVE-2023-22722 is a vulnerability in GLPI, a Free Asset and IT Management Software package, that allows an attacker to perform cross-site scripting (XSS) attacks by persuading a victim to open a URL containing malicious code.
How does CVE-2023-22722 work?
CVE-2023-22722 works by exploiting a vulnerability in GLPI versions 9.4.0 and above, prior to 10.0.6, which allows an attacker to inject malicious code into the victim's browser when they open a specially crafted URL.
What is the severity of CVE-2023-22722?
The severity of CVE-2023-22722 is medium with a CVSS score of 6.1.
How can I fix CVE-2023-22722?
To fix CVE-2023-22722, it is recommended to upgrade GLPI to version 10.0.6 or above.
Where can I find more information about CVE-2023-22722?
More information about CVE-2023-22722 can be found in the official GitHub security advisory of GLPI.

collector/nvd-index
agent/softwarecombine
agent/type
collector/mitre-cve
source/MITRE
agent/author
agent/severity
agent/references
agent/last-modified-date
agent/weakness
agent/title
agent/first-publish-date
agent/description
agent/tags
agent/event
vendor/glpi-project
canonical/glpi-project glpi
version/glpi-project glpi/9.4.0
version/glpi-project glpi/10.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.