CVE-2023-29006
Order GLPI plugin vulnerable to remote code execution from authenticated user
概要
Order GLPI plugin vulnerable to remote code execution from authenticated user
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the ajax/dropdownContact.php file from the plugin.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com