Vulnerability Details : CVE-2013-2225
Potential exploit
inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/ticket.form.php.
Products affected by CVE-2013-2225
- cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.72.4:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.72.3:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.72.2:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.5:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.4:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.78.1:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.78:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.72:rc2:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.72:rc1:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.1:rc3:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.70:rc1:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.68.3:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.68.2:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.65:rc2:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.65:rc1:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.5:rc2:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.78.3:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.78.2:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.6:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.72:rc3:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.1:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.70:rc3:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.70:rc2:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.68:rc1:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.65:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.51a:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.51:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.78.5:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.78.4:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.72.1:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.72:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.3:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.71.2:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.70.1:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.70:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.68:rc3:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.68:rc2:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.6:rc2:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.70.2:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.68.1:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.68:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.6:rc3:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.42:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80.1:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80.2:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80.3:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80.4:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80.6:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80.5:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80.61:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.31:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.30:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.21:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.1:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.41:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.80.7:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.20:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.40:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.6:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.5:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.4:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.31:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.7:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.3:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.8:*:*:*:*:*:*:*
- cpe:2.3:a:glpi-project:glpi:0.83.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-2225
15.51%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-2225
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:P |
10.0
|
4.9
|
NIST |
References for CVE-2013-2225
-
http://osvdb.org/94683
-
http://seclists.org/oss-sec/2013/q2/645
oss-sec: Re: CVE request for GLPI
-
http://seclists.org/oss-sec/2013/q2/626
oss-sec: CVE request for GLPI
-
https://forge.indepnet.net/projects/glpi/repository/revisions/21169/diff
Exploit;Patch
-
http://www.exploit-db.com/exploits/26530
GLPI 0.83.9 - 'Unserialize()' Remote Code Execution - PHP webapps ExploitExploit
-
http://www.securityfocus.com/bid/60823
GLPI 'unserialize()' Function Remote PHP Code Execution Vulnerability
Jump to