CVE-2023-28633 - Vulnerability Details - OpenCVE

GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Glpi-project	Glpi

Configuration 1 [-]

OR	cpe:2.3:a:glpi-project:glpi::::::::
	cpe:2.3:a:glpi-project:glpi::::::::

No data.

References

Link	Providers
https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982
https://github.com/glpi-project/glpi/releases/tag/10.0.7
https://github.com/glpi-project/glpi/releases/tag/9.5.13
https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf

History

Mon, 10 Feb 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-04-05T15:27:58.849Z

Updated: 2025-02-10T16:37:09.581Z

Reserved: 2023-03-20T12:19:47.207Z

Link: CVE-2023-28633

Vulnrichment

Updated: 2024-08-02T13:43:23.320Z

NVD

Status : Modified

Published: 2023-04-05T16:15:08.040

Modified: 2024-11-21T07:55:42.437

Link: CVE-2023-28633

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-28633", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-03-20T12:19:47.207Z", "datePublished": "2023-04-05T15:27:58.849Z", "dateUpdated": "2025-02-10T16:37:09.581Z"}, "containers": {"cna": {"title": "GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf"}, {"name": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982", "tags": ["x_refsource_MISC"], "url": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982"}, {"name": "https://github.com/glpi-project/glpi/releases/tag/10.0.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7"}, {"name": "https://github.com/glpi-project/glpi/releases/tag/9.5.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13"}], "affected": [{"vendor": "glpi-project", "product": "glpi", "versions": [{"version": ">= 0.84, < 9.5.13", "status": "affected"}, {"version": ">= 10.0.0, < 10.0.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-05T15:27:58.849Z"}, "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue."}], "source": {"advisory": "GHSA-r57v-j88m-rwwf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T13:43:23.320Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf"}, {"name": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982"}, {"name": "https://github.com/glpi-project/glpi/releases/tag/10.0.7", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7"}, {"name": "https://github.com/glpi-project/glpi/releases/tag/9.5.13", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-10T16:37:04.468215Z", "id": "CVE-2023-28633", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T16:37:09.581Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf", "name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982", "name": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7", "name": "https://github.com/glpi-project/glpi/releases/tag/10.0.7", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13", "name": "https://github.com/glpi-project/glpi/releases/tag/9.5.13", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T13:43:23.320Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-28633", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-10T16:37:04.468215Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T16:36:56.757Z"}}], "cna": {"title": "GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds", "source": {"advisory": "GHSA-r57v-j88m-rwwf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "glpi-project", "product": "glpi", "versions": [{"status": "affected", "version": ">= 0.84, < 9.5.13"}, {"status": "affected", "version": ">= 10.0.0, < 10.0.7"}]}], "references": [{"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf", "name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982", "name": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7", "name": "https://github.com/glpi-project/glpi/releases/tag/10.0.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13", "name": "https://github.com/glpi-project/glpi/releases/tag/9.5.13", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-05T15:27:58.849Z"}}}, "cveMetadata": {"cveId": "CVE-2023-28633", "state": "PUBLISHED", "dateUpdated": "2025-02-10T16:37:09.581Z", "dateReserved": "2023-03-20T12:19:47.207Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-04-05T15:27:58.849Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7C5D95C-F093-4B44-BF03-837C1D882066", "versionEndExcluding": "9.5.13", "versionStartIncluding": "0.84", "vulnerable": true}, {"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2989977-4BC4-4420-A342-3BF0E09591FB", "versionEndExcluding": "10.0.7", "versionStartIncluding": "10.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue."}], "id": "CVE-2023-28633", "lastModified": "2024-11-21T07:55:42.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-05T16:15:08.040", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes"], "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes"], "url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}