certfr_alerte - certfr-2022-ale-010

CERTFR-2022-ALE-010

Vulnerability from certfr_alerte

Le 14 septembre 2022, l'éditeur de GLPI (Gestionnaire Libre de Parc Informatique) a déclaré plusieurs vulnérabilités sur le produit, dont deux critiques. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

La vulnérabilité référencée par l'identifiant CVE-2022-35914 affecte bibliothèque tierce - htmLawed - qui est embarquée par GLPI. Elle est due à la présence d’un fichier de test htmLawedTest.php et permet à un attaquant non authentifié d’exécuter du code arbitraire à distance.

La seconde vulnérabilité immatriculée CVE-2022-35947 permet à un attaquant de réaliser une injection SQL afin d'obtenir une connexion avec n’importe quel utilisateur ayant au préalable défini une clé API.

Le CERT-FR a publié un bulletin d'actualité le 20 septembre 2022 afin de signaler l'existence de ces vulnérabilités.

Le CERT-FR a connaissance de nombreux incidents liés à l'exploitation de la vulnérabilité immatriculée CVE-2022-35914.

DÉTECTION

Il est recommandé d'effectuer une vérification des journaux à la recherche de tentatives d'accès aux ressources suivantes :

/vendor/htmlawed/htmlawed/htmLawedTest.php
/vendor/htmlawed/htmlawed/404.php
/vendor/

Par ailleurs, des requêtes vers les ressources suivantes peuvent être en lien avec l’attaque et doivent donc faire l'objet d'une attention particulière :

/redistest.php
/css/Arui.php
/css/legacy/Arui.php
/css/legacy/Arui1.php

Si ces requêtes sont observées, il sera alors nécessaire d'effectuer une vérification supplémentaire à la recherche de fichiers malveillants éventuellement déposés par un attaquant pour lui permettre de maintenir un accès au système compromis.

Le CERT-FR tient à rappeler plusieurs points importants :

Les produits tels que GLPI ne devraient pas être exposés sur Internet.
En cas d'obligation d'accès depuis l'extérieur, des mesures de sécurité doivent être mises en œuvre [1].
Dans tous les cas, le dossier /vendor/ qui contient les bibliothèques tierces ne devrait pas être publiquement accessible depuis Internet. Un tel dossier doit être déplacé en dehors de la racine du serveur Web de façon à prévenir tout accès par adressage direct aux fichiers présents dans ce dossier. Il n'existe aucune raison légitime qui justifierait qu'un visiteur puisse avoir accès à ce type de dossier.
Enfin, des restrictions d'accès direct sur le dossier /vendor/ doivent-être mises en place par le biais des configurations sur le serveur Web.

En cas de suspicion de compromission, il est recommandé de consulter les bons réflexes en cas d'intrusion sur votre système d'information [2].

Contournement provisoire

S'il n'est pas possible de déployer le correctif rapidement, il est fortement recommandé :

de désactiver l’option Enable login with external token dans le menu de configuration de l’API ;
de supprimer le fichier /vendor/htmlawed/htmlawed/htmLawedTest.php

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	GLPI	GLPI	GLPI versions 9.5.x antérieures à 9.5.9
	GLPI	GLPI	GLPI versions 10.0.x versions antérieures à 10.0.3

References

Title

Publication Time

Tags

Bulletin de sécurité GLPI	2022-09-14	vendor-advisory
[2] Bons réflexes en cas d'intrusion sur votre système d'information	-	other
[1] Guide ANSSI pour la sécurisation des services exposés sur Internet	-	other
Bulletin d'actualité CERTFR-2022-ACT-041 du 20 septembre 2022	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GLPI versions 9.5.x ant\u00e9rieures \u00e0 9.5.9",
      "product": {
        "name": "GLPI",
        "vendor": {
          "name": "GLPI",
          "scada": false
        }
      }
    },
    {
      "description": "GLPI versions 10.0.x versions ant\u00e9rieures \u00e0 10.0.3",
      "product": {
        "name": "GLPI",
        "vendor": {
          "name": "GLPI",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2023-03-14",
  "content": "## Contournement provisoire\n\nS\u0027il n\u0027est pas possible de d\u00e9ployer le correctif rapidement, il est\nfortement recommand\u00e9 :\n\n-   de d\u00e9sactiver l\u2019option *Enable login with external token* dans le\n    menu de configuration de l\u2019API ;\n-   de supprimer le fichier */vendor/htmlawed/htmlawed/htmLawedTest.php*\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-35947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35947"
    },
    {
      "name": "CVE-2022-35914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-35914"
    }
  ],
  "initial_release_date": "2022-10-07T00:00:00",
  "last_revision_date": "2023-03-14T00:00:00",
  "links": [
    {
      "title": "[2] Bons r\u00e9flexes en cas d\u0027intrusion sur votre syst\u00e8me d\u0027information",
      "url": "https://www.cert.ssi.gouv.fr/les-bons-reflexes-en-cas-dintrusion-sur-un-systeme-dinformation/"
    },
    {
      "title": "[1] Guide ANSSI pour la s\u00e9curisation des services expos\u00e9s sur Internet",
      "url": "https://www.ssi.gouv.fr/guide/recommandations-sur-le-nomadisme-numerique/"
    },
    {
      "title": "Bulletin d\u0027actualit\u00e9 CERTFR-2022-ACT-041 du 20 septembre 2022",
      "url": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2022-ACT-041/"
    }
  ],
  "reference": "CERTFR-2022-ALE-010",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-10-07T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2023-03-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Le 14 septembre 2022, l\u0027\u00e9diteur de GLPI (Gestionnaire Libre de Parc\nInformatique) a d\u00e9clar\u00e9 plusieurs vuln\u00e9rabilit\u00e9s sur le produit, dont\ndeux critiques. Elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance et un contournement de la\npolitique de s\u00e9curit\u00e9.\n\nLa vuln\u00e9rabilit\u00e9 r\u00e9f\u00e9renc\u00e9e par l\u0027identifiant CVE-2022-35914 affecte\nbiblioth\u00e8que tierce - *htmLawed* - qui est embarqu\u00e9e par GLPI. Elle est\ndue \u00e0 la pr\u00e9sence d\u2019un fichier de test *htmLawedTest.php* et permet \u00e0 un\nattaquant non authentifi\u00e9 d\u2019ex\u00e9cuter du code arbitraire \u00e0 distance.\n\nLa seconde vuln\u00e9rabilit\u00e9 immatricul\u00e9e CVE-2022-35947 permet \u00e0 un\nattaquant de r\u00e9aliser une injection SQL afin d\u0027obtenir une connexion\navec n\u2019importe quel utilisateur ayant au pr\u00e9alable d\u00e9fini une cl\u00e9 API.\n\nLe CERT-FR a publi\u00e9 un bulletin d\u0027actualit\u00e9 le 20 septembre 2022 afin de\nsignaler l\u0027existence de ces vuln\u00e9rabilit\u00e9s.\n\n\u003cspan style=\"color: #ff0000;\"\u003e\u003cstrong\u003eLe CERT-FR a connaissance de nombreux\nincidents li\u00e9s \u00e0 l\u0027exploitation de la vuln\u00e9rabilit\u00e9 immatricul\u00e9e\nCVE-2022-35914.\u003c/strong\u003e\u003c/span\u003e\n\n## \u003cstrong\u003eD\u00c9TECTION\u003c/strong\u003e\n\nIl est recommand\u00e9 d\u0027effectuer une v\u00e9rification des journaux \u00e0 la\nrecherche de tentatives d\u0027acc\u00e8s aux ressources suivantes :\n\n-   */vendor/htmlawed/htmlawed/htmLawedTest.php*\n-   */vendor/htmlawed/htmlawed/404.php*\n-   */vendor/*\n\nPar ailleurs, des requ\u00eates vers les ressources suivantes peuvent \u00eatre en\nlien avec l\u2019attaque et doivent donc faire l\u0027objet d\u0027une attention\nparticuli\u00e8re :\n\n-   */redistest.php*\n-   */css/Arui.php*\n-   */css/legacy/Arui.php*\n-   */css/legacy/Arui1.php*\n\nSi ces requ\u00eates sont observ\u00e9es, il sera alors n\u00e9cessaire d\u0027effectuer une\nv\u00e9rification suppl\u00e9mentaire \u00e0 la recherche de fichiers malveillants\n\u00e9ventuellement d\u00e9pos\u00e9s par un attaquant pour lui permettre de maintenir\nun acc\u00e8s au syst\u00e8me compromis.\n\nLe CERT-FR tient \u00e0 rappeler plusieurs points importants :\n\n-   Les produits tels que GLPI ne devraient pas \u00eatre expos\u00e9s sur\n    Internet.\n-   En cas d\u0027obligation d\u0027acc\u00e8s depuis l\u0027ext\u00e9rieur, des mesures de\n    s\u00e9curit\u00e9 doivent \u00eatre mises en \u0153uvre \\[1\\].\n-   Dans tous les cas, le dossier */vendor/* qui contient les\n    biblioth\u00e8ques tierces ne devrait pas \u00eatre publiquement accessible\n    depuis Internet. Un tel dossier doit \u00eatre d\u00e9plac\u00e9 en dehors de la\n    racine du serveur Web de fa\u00e7on \u00e0 pr\u00e9venir tout acc\u00e8s par adressage\n    direct aux fichiers pr\u00e9sents dans ce dossier. Il n\u0027existe aucune\n    raison l\u00e9gitime qui justifierait qu\u0027un visiteur puisse avoir acc\u00e8s \u00e0\n    ce type de dossier.\n-   Enfin, des restrictions d\u0027acc\u00e8s direct sur le dossier */vendor/*\n    doivent-\u00eatre mises en place par le biais des configurations sur le\n    serveur Web.\n\nEn cas de suspicion de compromission, il est recommand\u00e9 de consulter les\n[bons r\u00e9flexes en cas d\u0027intrusion sur votre syst\u00e8me\nd\u0027information](/les-bons-reflexes-en-cas-dintrusion-sur-un-systeme-dinformation/)\n\\[2\\].\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GLPI",
  "vendor_advisories": [
    {
      "published_at": "2022-09-14",
      "title": "Bulletin de s\u00e9curit\u00e9 GLPI",
      "url": "https://github.com/glpi-project/glpi/security/advisories"
    }
  ]
}

CVE-2022-35947 (GCVE-0-2022-35947)

Vulnerability from cvelistv5

Published

2022-09-14 17:50

Modified

2025-04-23 17:10

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration.

References

URL

Tags

	https://github.com/glpi-project/glpi/security/advisories/GHSA-7p3q-cffg-c8xh	x_refsource_CONFIRM
	https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	glpi-project	glpi	Version: >= 9.1, < 10.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:51:59.148Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-7p3q-cffg-c8xh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-35947",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:48:39.516167Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T17:10:29.036Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glpi",
          "vendor": "glpi-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.1, \u003c 10.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-14T17:50:09.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-7p3q-cffg-c8xh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962"
        }
      ],
      "source": {
        "advisory": "GHSA-7p3q-cffg-c8xh",
        "discovery": "UNKNOWN"
      },
      "title": "SQL injection in GLPI",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-35947",
          "STATE": "PUBLIC",
          "TITLE": "SQL injection in GLPI"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "glpi",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 9.1, \u003c 10.0.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "glpi-project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-7p3q-cffg-c8xh",
              "refsource": "CONFIRM",
              "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-7p3q-cffg-c8xh"
            },
            {
              "name": "https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962",
              "refsource": "MISC",
              "url": "https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-7p3q-cffg-c8xh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-35947",
    "datePublished": "2022-09-14T17:50:09.000Z",
    "dateReserved": "2022-07-15T00:00:00.000Z",
    "dateUpdated": "2025-04-23T17:10:29.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-35914 (GCVE-0-2022-35914)

Vulnerability from cvelistv5

Published

2022-09-19 00:00

Modified

2025-07-30 01:37

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Summary

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

References

URL

Tags

	http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed
	https://github.com/glpi-project/glpi/releases
	https://glpi-project.org/fr/glpi-10-0-3-disponible/
	http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
	https://github.com/Orange-Cyberdefense/CVE-repository/
	https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh
	https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:44:22.145Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?\u0026Sfs=htmLawedTest.php\u0026Sl=.%2Finternal_utilities%2FhtmLawed"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/glpi-project/glpi/releases"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://glpi-project.org/fr/glpi-10-0-3-disponible/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-35914",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T16:21:19.269071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-03-07",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:37:38.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2023-03-07T00:00:00+00:00",
            "value": "CVE-2022-35914 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-07T19:34:04.621Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?\u0026Sfs=htmLawedTest.php\u0026Sl=.%2Finternal_utilities%2FhtmLawed"
        },
        {
          "url": "https://github.com/glpi-project/glpi/releases"
        },
        {
          "url": "https://glpi-project.org/fr/glpi-10-0-3-disponible/"
        },
        {
          "url": "http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html"
        },
        {
          "url": "https://github.com/Orange-Cyberdefense/CVE-repository/"
        },
        {
          "url": "https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh"
        },
        {
          "url": "https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-35914",
    "datePublished": "2022-09-19T00:00:00.000Z",
    "dateReserved": "2022-07-15T00:00:00.000Z",
    "dateUpdated": "2025-07-30T01:37:38.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2022-ALE-010

Vulnerability from certfr_alerte

DÉTECTION

Contournement provisoire

Solution

CVE-2022-35947 (GCVE-0-2022-35947)

Vulnerability from cvelistv5

CVE-2022-35914 (GCVE-0-2022-35914)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature