medium5.3Public exploit code
CVE-2022-31062
### Impact A plugin public script can be used to read content of system files.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion2023-04-03 · webapps · php
Impact
### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file can be deleted if deploy feature is not used.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Glpi-Project | Glpi Inventory | before 1.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.html
- https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q33f-jcjf-p4v9
- http://packetstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.html
- https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q33f-jcjf-p4v9