GLPI up to 9.5.12/10.0.6 RSS Feed server-side request forgery

Summaryinfo

A vulnerability labeled as critical has been found in GLPI up to 9.5.12/10.0.6. The affected element is an unknown function of the component RSS Feed Handler. Executing a manipulation can lead to server-side request forgery. This vulnerability appears as CVE-2023-28633. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in GLPI up to 9.5.12/10.0.6 (Asset Management Software). It has been declared as critical. This vulnerability affects an unknown part of the component RSS Feed Handler. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

The weakness was presented 04/06/2023 as GHSA-r57v-j88m-rwwf. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-28633 since 03/20/2023. There are neither technical details nor an exploit publicly available.

Upgrading to version 9.5.13 or 10.0.7 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch e2819da64c9075050805a44c834e1f4dc621a982 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Asset Management Software

Name

• GLPI

Version

• 9.5.0
• 9.5.1
• 9.5.2
• 9.5.3
• 9.5.4
• 9.5.5
• 9.5.6
• 9.5.7
• 9.5.8
• 9.5.9
• 9.5.10
• 9.5.11
• 9.5.12
• 10.0.0
• 10.0.1
• 10.0.2
• 10.0.3
• 10.0.4
• 10.0.5
• 10.0.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion