CVE-2023-22500

glpi Unauthorized access to inventory files

State: Published
Severity: 7.5 High
Published: Jan 25, 2023
Updated: Mar 10, 2025
Reserved: Dec 29, 2022

Description

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by unauthenticated users. This issue is patched in version 10.0.6. As a workaround, disable native inventory and delete inventory files from server (default location is `files/_inventory`).

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
glpiglpi-project	>= 10.0.0, < 10.0.6Affected

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-3ghv-p34r-5ghx

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.