CVE-2022-35914criticalunder attackCWE-74

CVE-2022-35914

Published · Updated

Follow this CVE+ Monitor GLPI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon11 days
Published on NVDSep 19
1st PoC+11d
metasploitJan 26
CISA KEV+169d
Action required by CISAfederal deadline: 2023-03-28

Apply updates per vendor instructions.

In short

A test file left in the htmlawed module of GLPI allows attackers to inject and execute arbitrary PHP code on the server. This is a critical vulnerability that gives attackers complete control over the system.

Technical detail

The htmLawedTest.php file in the htmlawed vendor module is publicly accessible and accepts untrusted input that is evaluated as PHP code (CWE-74: Improper Neutralization of Special Elements in Output). Remote attackers can achieve unauthenticated remote code execution on GLPI versions up to 10.0.2, resulting in full system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.