Skip to content

Unauthenticated Local File Inclusion

High
cedric-anne published GHSA-q33f-jcjf-p4v9 Jun 20, 2022

Package

glpiinventory (glpi)

Affected versions

<= 1.0.1

Patched versions

1.0.2

Description

Impact

A plugin public script can be used to read content of system files.

Patches

Upgrade to version 1.0.2.

Workarounds

b/deploy/index.php file can be deleted if deploy feature is not used.

Severity

High
7.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVE ID

CVE-2022-31062

Weaknesses

Credits