CVE-2023-36808
HighCVSS 8.6Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
GLPI, an IT asset management software, is vulnerable to SQL injection in the Computer Virtual Machine form and inventory request. This issue affects versions from 0.80 up to but not including 10.0.8, with a patch available in version 10.0.8.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to exposure of sensitive information or data manipulation.
Recommendation
It is recommended to upgrade GLPI to version 10.0.8 or disable native inventory as a temporary workaround.
Original NVD description (English source)
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.