CVE-2023-22724

 

Published at: - 26-01-2023 10:18

Last modified: - 27-01-2023 03:03

Total changes: - 2

Description

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff

 

Keywords

NVD

 

CVE-2023-22724

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures