CVE-2023-34244
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
GLPI is a free asset and IT management software package. In versions from 9.4.0 to prior to 10.0.8, a malicious link can be crafted by an unauthenticated user, leading to a reflected XSS vulnerability if any authenticated user opens the crafted link.
Risk Assessment
The organization is exposed to XSS attacks that could lead to session hijacking or the introduction of malicious code. This could result in data loss or a breach of system security.
Recommendation
It is recommended to upgrade to version 10.0.8 to patch this vulnerability. Regular software updates are crucial for maintaining system security.
Original NVD description (English source)
GLPI is a free asset and IT management software package. Starting in version 9.4.0 and prior to version 10.0.8, a malicious link can be crafted by an unauthenticated user that can exploit a reflected XSS in case any authenticated user opens the crafted link. Users should upgrade to version 10.0.8 to receive a patch.