CVE-2023-28855CWE-269

Fields GLPI plugin vulnerable to unauthorized write access to additional fields

Medium · published April 5, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2023-04-05T17:48Z
EPSS history
Timeline
  • 05 APR 17:48Z
    Fields GLPI plugin vulnerable to unauthorized write access to additional fields
    cvelistv5