CVE-2022-21720

Description

GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.

Weakness classification

• nvd@nist.gov: CWE-89
• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-89

Primary references

• security-advisories@github.com — Patch, Third Party Advisory
• security-advisories@github.com — Release Notes, Third Party Advisory
• security-advisories@github.com — Mitigation, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory