1. Home
  2. CVE Database
  3. CVE-2023-22724
MEDIUM · 6.2

CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that con...

Vulnerability Description

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.

CVSS Score

6.2

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Glpi-ProjectGlpi>= 10.0.0, < 10.0.6

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2023-22724?

CVE-2023-22724 is a vulnerability with a CVSS score of 6.2 (MEDIUM). GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that con...

How severe is CVE-2023-22724?

CVE-2023-22724 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-22724?

Check the references section above for vendor advisories and patch information. Affected products include: Glpi-Project Glpi.