Vulnerability Details : CVE-2022-24867
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.
Vulnerability category: Information leak
Products affected by CVE-2022-24867
- cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-24867
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-24867
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:C/I:N/A:N |
10.0
|
6.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2022-24867
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: security-advisories@github.com (Secondary)
-
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-24867
-
https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e
Do not expose old ldap pass · glpi-project/glpi@26f0a20 · GitHubPatch;Third Party Advisory
-
https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr
LDAP password exposed on source code · Advisory · glpi-project/glpi · GitHubThird Party Advisory
Jump to