CVE-2022-31082CWE-89

SQL Injection via package deployment tasks in glpi-inventory-plugin

Medium · published June 27, 2022

CVSS v3.1
5.8
EPSS
1%
Percentile
62.9
In the wild
Unconfirmed
What it is

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01014 · 62.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-06-27T20:30Z
EPSS history
Timeline
  • 27 JUN 20:30Z
    SQL Injection via package deployment tasks in glpi-inventory-plugin
    cvelistv5