CVE-2022-29250CWE-89

SQL injection in GLPI

High · published June 9, 2022

CVSS v3.1
8.1
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00806 · 56.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-06-09T19:55Z
EPSS history
Timeline
  • 09 JUN 19:55Z
    SQL injection in GLPI
    cvelistv5