CVE-2022-41941CWE-79

glpi contains XSS Stored inside Standard Interface Help Link href attribute

Medium · published January 25, 2023

CVSS v3.1
6.2
EPSS
1%
Percentile
46.8
In the wild
Unconfirmed
What it is

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00577 · 46.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-01-25T06:06Z
EPSS history
Timeline
  • 25 JAN 06:06Z
    glpi contains XSS Stored inside Standard Interface Help Link href attribute
    cvelistv5