CVE-2022-31068CWE-200

Sensitive Data Exposure on Refused Inventory Files in GLPI

Medium · published June 28, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
59.8
In the wild
Unconfirmed
What it is

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00916 · 59.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-06-28T17:50Z
EPSS history
Timeline
  • 28 JUN 17:50Z
    Sensitive Data Exposure on Refused Inventory Files in GLPI
    cvelistv5