CVE-2023-28855

EUVD-2023-32479 · Published Apr 5, 2023

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.

Technologies

Teclib-Edition Fields

Weaknesses

CWE-269

CVSS scores

v3.16.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Privilege Escalation

T1190Exploit Public-Facing Application T1548Abuse Elevation Control Mechanism

References

https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d
https://github.com/pluginsGLPI/fields/releases/tag/1.13.1
https://github.com/pluginsGLPI/fields/releases/tag/1.20.4
https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584

Potentially impacted assets

See if this affects your attack surface