CVE-2022-21720

SQL injection using custom CSS administration form in GLPI

Medium · published January 28, 2022

CVSS v3.1
4.9
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01103 · 65.5th percentile
Published
2022-01-28T10:15Z
EPSS history
Timeline
  • 28 JAN 10:15Z
    SQL injection using custom CSS administration form in GLPI
    cvelistv5