CVE-2022-39277CWE-79CWE-80

Cross-Site Scripting (XSS) in external links in GLPI

Medium · published November 3, 2022

CVSS v3.1
4.5
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to GLPI 10.0.4. There are currently no known workarounds.

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00595 · 47.7th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2022-11-03T00:00Z
EPSS history
Timeline
  • 03 NOV 00:00Z
    Cross-Site Scripting (XSS) in external links in GLPI
    cvelistv5