MEDIUM🇵🇱 Wersja polska

CVE-2023-28855

CVSS 6.5v3.1pub. 2023-04-05upd. 2024-11-21

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

  • Teclib Edition Fields

    APP
    Teclib-Edition
    < 1.13.11.20.0 – 1.20.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Container
CWE
References

Related vulnerabilities

CVE-2026-23489CRITICAL9.1PL ✓same product

RCE przez tworzenie dropdownów w pluginie Fields dla GLPI

CVE-2019-12723CRITICAL9.8PL ✓same product

SQL Injection w Teclib Fields plugin dla GLPI — dostęp bez uwierzytelnienia

CVE-2021-43779CRITICAL9.9PL ✓same vendor

RCE w pluginie GLPI Addressing — command injection po uwierzytelnieniu

CVE-2019-10232CRITICAL9.8PL ✓same vendor

SQL injection w GLPI via parametr 'cycle' w skrypcie unlock_tasks.php

CVE-2019-10231CRITICAL9.8PL ✓same vendor

Pominięcie uwierzytelnienia w GLPI przez PHP type juggling