certfr_avis - certfr-2026-avi-0117

CERTFR-2026-AVI-0117

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans GLPI. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection SQL (SQLi) et une falsification de requêtes côté serveur (SSRF).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	GLPI	GLPI	GLPI versions postérieures ou égales à 0.71 et antérieures à 10.0.23
	GLPI	GLPI	GLPI versions 11.0.x antérieures à 11.0.5

References

Title

Publication Time

Tags

Bulletin de sécurité GLPI GHSA-569q-j526-w385	2026-02-04	vendor-advisory
Bulletin de sécurité GLPI GHSA-5j4j-vx46-r477	2026-02-04	vendor-advisory
Bulletin de sécurité GLPI GHSA-f6f6-v3qr-9p5x	2026-02-04	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GLPI versions post\u00e9rieures ou \u00e9gales \u00e0 0.71 et ant\u00e9rieures \u00e0 10.0.23",
      "product": {
        "name": "GLPI",
        "vendor": {
          "name": "GLPI",
          "scada": false
        }
      }
    },
    {
      "description": "GLPI versions 11.0.x ant\u00e9rieures \u00e0 11.0.5",
      "product": {
        "name": "GLPI",
        "vendor": {
          "name": "GLPI",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-23624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23624"
    },
    {
      "name": "CVE-2026-22044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22044"
    },
    {
      "name": "CVE-2026-22247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22247"
    }
  ],
  "initial_release_date": "2026-02-04T00:00:00",
  "last_revision_date": "2026-02-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0117",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans GLPI. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection SQL (SQLi) et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans GLPI",
  "vendor_advisories": [
    {
      "published_at": "2026-02-04",
      "title": "Bulletin de s\u00e9curit\u00e9 GLPI GHSA-569q-j526-w385",
      "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-569q-j526-w385"
    },
    {
      "published_at": "2026-02-04",
      "title": "Bulletin de s\u00e9curit\u00e9 GLPI GHSA-5j4j-vx46-r477",
      "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-5j4j-vx46-r477"
    },
    {
      "published_at": "2026-02-04",
      "title": "Bulletin de s\u00e9curit\u00e9 GLPI GHSA-f6f6-v3qr-9p5x",
      "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-f6f6-v3qr-9p5x"
    }
  ]
}

CVE-2026-22044 (GCVE-0-2026-22044)

Vulnerability from cvelistv5

Published

2026-02-04 17:15

Modified

2026-02-04 19:27

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.

References

URL

Tags

	https://github.com/glpi-project/glpi/security/advisories/GHSA-569q-j526-w385	x_refsource_CONFIRM
	https://github.com/glpi-project/glpi/releases/tag/10.0.23	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	glpi-project	glpi	Version: >= 0.85, < 10.0.23

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22044",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T19:27:25.137739Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T19:27:43.406Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glpi",
          "vendor": "glpi-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.85, \u003c 10.0.23"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T17:15:39.205Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-569q-j526-w385",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-569q-j526-w385"
        },
        {
          "name": "https://github.com/glpi-project/glpi/releases/tag/10.0.23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.23"
        }
      ],
      "source": {
        "advisory": "GHSA-569q-j526-w385",
        "discovery": "UNKNOWN"
      },
      "title": "GLPI is Vulnerable to Authenticated SQL Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22044",
    "datePublished": "2026-02-04T17:15:39.205Z",
    "dateReserved": "2026-01-05T22:30:38.720Z",
    "dateUpdated": "2026-02-04T19:27:43.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22247 (GCVE-0-2026-22247)

Vulnerability from cvelistv5

Published

2026-02-04 17:10

Modified

2026-02-05 14:33

Severity ?

4.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.

References

URL

Tags

	https://github.com/glpi-project/glpi/security/advisories/GHSA-f6f6-v3qr-9p5x	x_refsource_CONFIRM
	https://github.com/glpi-project/glpi/releases/tag/11.0.5	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	glpi-project	glpi	Version: >= 11.0.0, < 11.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22247",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-05T14:20:18.955924Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-05T14:33:19.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glpi",
          "vendor": "glpi-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 11.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T17:10:30.153Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-f6f6-v3qr-9p5x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-f6f6-v3qr-9p5x"
        },
        {
          "name": "https://github.com/glpi-project/glpi/releases/tag/11.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/glpi-project/glpi/releases/tag/11.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-f6f6-v3qr-9p5x",
        "discovery": "UNKNOWN"
      },
      "title": "GLPI is Vulnerable to SSRF via Webhooks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22247",
    "datePublished": "2026-02-04T17:10:30.153Z",
    "dateReserved": "2026-01-07T05:19:12.921Z",
    "dateUpdated": "2026-02-05T14:33:19.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23624 (GCVE-0-2026-23624)

Vulnerability from cvelistv5

Published

2026-02-04 17:15

Modified

2026-02-04 19:56

Severity ?

4.3 (Medium) - CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-384 - Session Fixation

Summary

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .

References

URL

Tags

	https://github.com/glpi-project/glpi/security/advisories/GHSA-5j4j-vx46-r477	x_refsource_CONFIRM
	https://github.com/glpi-project/glpi/releases/tag/10.0.23	x_refsource_MISC
	https://github.com/glpi-project/glpi/releases/tag/11.0.5	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	glpi-project	glpi	Version: >= 0.71, < 10.0.23 Version: >= 11.0.0-alpha, < 11.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T19:56:08.999117Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T19:56:27.764Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glpi",
          "vendor": "glpi-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.71, \u003c 10.0.23"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0-alpha, \u003c 11.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions ."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384: Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T17:15:33.750Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-5j4j-vx46-r477",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-5j4j-vx46-r477"
        },
        {
          "name": "https://github.com/glpi-project/glpi/releases/tag/10.0.23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.23"
        },
        {
          "name": "https://github.com/glpi-project/glpi/releases/tag/11.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/glpi-project/glpi/releases/tag/11.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-5j4j-vx46-r477",
        "discovery": "UNKNOWN"
      },
      "title": "GLPI is vulnerable to session stealing on externally authenticated user change"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23624",
    "datePublished": "2026-02-04T17:15:33.750Z",
    "dateReserved": "2026-01-14T16:08:37.482Z",
    "dateUpdated": "2026-02-04T19:56:27.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2026-AVI-0117

Vulnerability from certfr_avis

Solutions

CVE-2026-22044 (GCVE-0-2026-22044)

Vulnerability from cvelistv5

CVE-2026-22247 (GCVE-0-2026-22247)

Vulnerability from cvelistv5

CVE-2026-23624 (GCVE-0-2026-23624)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature