Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.
References
Configurations
Configuration 1 (hide)
|
History
12 Apr 2023, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | (MISC) https://github.com/pluginsGLPI/fields/releases/tag/1.13.1 - Release Notes | |
| References | (MISC) https://github.com/pluginsGLPI/fields/releases/tag/1.20.4 - Release Notes | |
| References | (MISC) https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584 - Vendor Advisory | |
| References | (MISC) https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d - Patch | |
| First Time |
Teclib-edition
Teclib-edition fields |
|
| CPE | cpe:2.3:a:teclib-edition:fields:*:*:*:*:*:glpi:*:* |
05 Apr 2023, 18:47
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-05 18:15
Updated : 2023-04-12 16:38
NVD link : CVE-2023-28855
Mitre link : CVE-2023-28855
JSON object : View
Products Affected
teclib-edition
- fields
CWE
CWE-269
Improper Privilege Management