CVE-2023-22722CWE-79

glpi subject to Cross-site Scripting (XSS) - Reflected

Medium · published January 25, 2023

CVSS v3.1
6.8
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the victim or exfiltrate session cookies. This issue is patched in version 10.0.6.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00619 · 49.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-01-25T05:58Z
EPSS history
Timeline
  • 25 JAN 05:58Z
    glpi subject to Cross-site Scripting (XSS) - Reflected
    cvelistv5