Skip to content

XSS through registration API

Low
trasher published GHSA-jrgw-cx24-56x5 Sep 14, 2022

Package

glpi (glpi)

Affected versions

>= 9.5.0 & <= 10.0.3

Patched versions

10.0.3

Description

Impact

Information associated to registration key are not properly escaped in registration key configuration page. They can be used to steal GLPI administrator cookie.

Patches

Upgrade to 10.0.3.

Workarounds

Do not use a registration key created by an untrusted person.

Severity

Low

CVE ID

CVE-2022-35945

Weaknesses

Credits