GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/glpi-project/glpi/commit/5c3eee696b503fdf502f506b00d15cf5b324b326 | Patch Third Party Advisory |
| https://github.com/glpi-project/glpi/releases/tag/9.5.7 | Release Notes Third Party Advisory |
| https://github.com/glpi-project/glpi/security/advisories/GHSA-5hg4-r64r-rf83 | Mitigation Third Party Advisory |
| https://github.com/glpi-project/glpi/commit/5c3eee696b503fdf502f506b00d15cf5b324b326 | Patch Third Party Advisory |
| https://github.com/glpi-project/glpi/releases/tag/9.5.7 | Release Notes Third Party Advisory |
| https://github.com/glpi-project/glpi/security/advisories/GHSA-5hg4-r64r-rf83 | Mitigation Third Party Advisory |
Configurations
History
21 Nov 2024, 06:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/glpi-project/glpi/commit/5c3eee696b503fdf502f506b00d15cf5b324b326 - Patch, Third Party Advisory | |
| References | () https://github.com/glpi-project/glpi/releases/tag/9.5.7 - Release Notes, Third Party Advisory | |
| References | () https://github.com/glpi-project/glpi/security/advisories/GHSA-5hg4-r64r-rf83 - Mitigation, Third Party Advisory |
Information
Published : 2022-01-28 11:15
Updated : 2025-05-05 17:17
NVD link : CVE-2022-21720
Mitre link : CVE-2022-21720
CVE.ORG link : CVE-2022-21720
JSON object : View
Products Affected
glpi-project
- glpi
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')