CVE-2022-24867

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada glpi-project glpi. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.

Rincian

Terbit di NVD

21 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e patch · advisory pihak ketiga
• https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr advisory pihak ketiga