CVE-2023-28855: Fields GLPI plugin vulnerable to unauthorized write access to additional fields
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-28855?
CVE-2023-28855 is a vulnerability in the Fields plugin for GLPI that allows authenticated users to write data to fields containers they don't have access to.
What is the severity of CVE-2023-28855?
The severity of CVE-2023-28855 is medium, with a CVSS score of 6.5.
How can I fix CVE-2023-28855?
To fix CVE-2023-28855, update the Fields plugin to version 1.13.1 or version 1.20.4 or later.
Where can I find more information about CVE-2023-28855?
You can find more information about CVE-2023-28855 in the following references: [GitHub Commit](https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d), [GLPI Fields plugin 1.13.1 Release](https://github.com/pluginsGLPI/fields/releases/tag/1.13.1), [GLPI Fields plugin 1.20.4 Release](https://github.com/pluginsGLPI/fields/releases/tag/1.20.4).
What is the CWE for CVE-2023-28855?
The CWE for CVE-2023-28855 is CWE-269 (Improper Privilege Management).