CVE-2023-22724

Published: Jan 26, 2023Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.

Affected (1)

Products: Glpi Project: Glpi

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Glpi Project Glpi	From 10.0.0 to 10.0.6

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff

Source: security-advisories@github.com

Third Party Advisory

https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.