CVE-2023-35924
Published: 05 July 2023
Summary
CVE-2023-35924 is a high-severity SQL Injection (CWE-89) vulnerability in Glpi-Project Glpi. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
GLPI, an open-source IT asset management application, contains a SQL injection vulnerability (CWE-89) in its native inventory endpoint. The flaw affects versions 10.0.0 through 10.0.7 and carries a CVSS 3.1 score of 8.6. By default the endpoint accepts unauthenticated requests, allowing remote attackers to submit crafted inventory data that is processed directly in database queries.
An unauthenticated network attacker can leverage the endpoint to extract arbitrary data from the GLPI database. The attack requires no user interaction and results in a confidentiality breach that affects resources beyond the vulnerable component itself, while leaving integrity and availability untouched.
The project addressed the issue in release 10.0.8. Official advisories recommend upgrading to that version or, as a temporary workaround, disabling the native inventory feature. The associated EPSS score has remained flat at 0.1785 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-39915
Vulnerability details
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version…
more
10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.