Cyber Resilience

CVE-2023-36808

High

Published: 05 July 2023

Published
05 July 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.1578 94.9th percentile
Risk Priority 27 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-36808 is a high-severity SQL Injection (CWE-89) vulnerability in Glpi-Project Glpi. Its CVSS base score is 8.6 (High).

Operationally, ranked in the top 5.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

GLPI, an open-source IT asset management application, contains a SQL injection vulnerability (CWE-89) affecting the Computer Virtual Machine form and native inventory request processing. The flaw is present in all versions from 0.80 through 10.0.7 and carries a CVSS 3.1 score of 8.6, reflecting network attackability without authentication or user interaction and a confidentiality impact that extends beyond the vulnerable component.

An unauthenticated remote attacker can submit crafted input through these entry points to execute arbitrary SQL queries against the backend database, potentially extracting sensitive data such as credentials or configuration details. Because the vulnerability is reachable via the inventory interface, any system that accepts GLPI inventory submissions is exposed.

The official GLPI 10.0.8 release and accompanying GitHub Security Advisory GHSA-vf5h-jh9q-2gjm state that the issue is resolved by applying that update; administrators who cannot upgrade immediately may mitigate exposure by disabling the native inventory feature. The associated EPSS scores have remained in the 0.15–0.19 range without a pronounced post-disclosure climb.

EU & UK References

Vulnerability details

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a…

more

patch for this issue. As a workaround, one may disable native inventory.

CWE(s)
CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

glpi-project
glpi
0.80 — 10.0.8

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References