CVE-2023-36808

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

47.84% chance of exploitation in the next 30 days, 99th percentile

Published

2023-07-05

Updated

2024-10-18

Proof-of-concept exploits (1)

• fransosiche/exploit-cve-2023-36808

References

• CVE Record
• NVD entry

Related

• CVE-2023-36806
• CVE-2023-36809
• CVE-2023-36802
• CVE-2023-3681
• CVE-2023-3676
• CVE-2023-36812