Vulnerability Details : CVE-2023-28855
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.
Products affected by CVE-2023-28855
- cpe:2.3:a:teclib-edition:fields:*:*:*:*:*:glpi:*:*
- cpe:2.3:a:teclib-edition:fields:*:*:*:*:*:glpi:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-28855
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 34 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-28855
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2023-28855
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2023-28855
-
https://github.com/pluginsGLPI/fields/releases/tag/1.20.4
Release 1.20.4 · pluginsGLPI/fields · GitHubRelease Notes
-
https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584
Unauthorized write access to additionnal fields · Advisory · pluginsGLPI/fields · GitHubVendor Advisory
-
https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d
Merge pull request from GHSA-52vv-hm4x-8584 · pluginsGLPI/fields@784260b · GitHubPatch
-
https://github.com/pluginsGLPI/fields/releases/tag/1.13.1
Release 1.13.1 · pluginsGLPI/fields · GitHubRelease Notes
Jump to