Teclib · GLPI
CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
Exploited in attacks
Critical 9.8 Attack chance: 99.9%
What it is
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
CISA: Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 28, 2023
- Added to the CISA list
- March 7, 2023
- Published
- September 19, 2022
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-74
- More details
- NVD · CVE.org · CISA
All references (7)
- http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilitie…
- https://github.com/glpi-project/glpi/releases
- https://glpi-project.org/fr/glpi-10-0-3-disponible/
- http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
- https://github.com/Orange-Cyberdefense/CVE-repository/
- https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh
- https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.