CVE-2023-22722

glpi subject to Cross-site Scripting (XSS) - Reflected

State: Published
Severity: 6.8 Medium
Published: Jan 25, 2023
Updated: Mar 10, 2025
Reserved: Jan 6, 2023

Description

GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the victim or exfiltrate session cookies. This issue is patched in version 10.0.6.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
glpiglpi-project	>= 9.4.0, < 10.0.6Affected

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-352j-wr38-493c

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.