CVE-2023-28639 - Vulnerability Details - OpenCVE

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Glpi-project	Glpi

Configuration 1 [-]

OR	cpe:2.3:a:glpi-project:glpi::::::::
	cpe:2.3:a:glpi-project:glpi::::::::

No data.

References

Link	Providers
https://github.com/glpi-project/glpi/releases/tag/10.0.7
https://github.com/glpi-project/glpi/releases/tag/9.5.13
https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4

History

Mon, 10 Feb 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-04-05T00:00:00.000Z

Updated: 2025-02-13T16:48:48.001Z

Reserved: 2023-03-20T00:00:00.000Z

Link: CVE-2023-28639

Vulnrichment

Updated: 2024-08-02T13:43:23.641Z

NVD

Status : Modified

Published: 2023-04-05T18:15:08.310

Modified: 2024-11-21T07:55:43.200

Link: CVE-2023-28639

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-28639", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2025-02-13T16:48:48.001Z", "dateReserved": "2023-03-20T00:00:00.000Z", "datePublished": "2023-04-05T00:00:00.000Z"}, "containers": {"cna": {"title": "GLPI vulnerable to reflected Cross-site Scripting in search pages", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-05T17:35:05.942Z"}, "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7."}], "affected": [{"vendor": "glpi", "product": "glpi", "versions": [{"version": "0.85", "status": "affected", "lessThan": "0.85*", "versionType": "custom"}, {"version": "9.5.13", "status": "affected", "lessThan": "9.5.13", "versionType": "custom"}, {"version": "10.0.0", "status": "affected", "lessThan": "10.0.0*", "versionType": "custom"}, {"version": "10.0.7", "status": "affected", "lessThan": "10.0.7", "versionType": "custom"}]}], "references": [{"url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7"}, {"url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13"}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-79 Cross-site Scripting (XSS)", "cweId": "CWE-79"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "GHSA-r93q-chh5-jgh4", "defect": ["GHSA-r93q-chh5-jgh4"], "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T13:43:23.641Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7", "tags": ["x_transferred"]}, {"url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13", "tags": ["x_transferred"]}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-10T20:23:41.677705Z", "id": "CVE-2023-28639", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T20:23:49.298Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7", "tags": ["x_transferred"]}, {"url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13", "tags": ["x_transferred"]}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T13:43:23.641Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-28639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-10T20:23:41.677705Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T20:23:36.390Z"}}], "cna": {"title": "GLPI vulnerable to reflected Cross-site Scripting in search pages", "source": {"defect": ["GHSA-r93q-chh5-jgh4"], "advisory": "GHSA-r93q-chh5-jgh4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "glpi", "product": "glpi", "versions": [{"status": "affected", "version": "0.85", "lessThan": "0.85*", "versionType": "custom"}, {"status": "affected", "version": "9.5.13", "lessThan": "9.5.13", "versionType": "custom"}, {"status": "affected", "version": "10.0.0", "lessThan": "10.0.0*", "versionType": "custom"}, {"status": "affected", "version": "10.0.7", "lessThan": "10.0.7", "versionType": "custom"}]}], "references": [{"url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7"}, {"url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13"}, {"url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-05T17:35:05.942Z"}}}, "cveMetadata": {"cveId": "CVE-2023-28639", "state": "PUBLISHED", "dateUpdated": "2025-02-13T16:48:48.001Z", "dateReserved": "2023-03-20T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-04-05T00:00:00.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B6B5A31-CA54-4907-A9FA-C11B71200EE8", "versionEndExcluding": "9.5.13", "versionStartIncluding": "0.85", "vulnerable": true}, {"criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2989977-4BC4-4420-A342-3BF0E09591FB", "versionEndExcluding": "10.0.7", "versionStartIncluding": "10.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7."}], "id": "CVE-2023-28639", "lastModified": "2024-11-21T07:55:43.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-05T18:15:08.310", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes"], "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes"], "url": "https://github.com/glpi-project/glpi/releases/tag/9.5.13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}