CVE-2023-28855

EUVD-2023-32479
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
GitHub_MCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
Affected Products (NVD)
VendorProductVersion
teclib-editionfields
𝑥
< 1.13.1
teclib-editionfields
1.20.0 ≤
𝑥
< 1.20.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d
https://github.com/pluginsGLPI/fields/releases/tag/1.13.1
https://github.com/pluginsGLPI/fields/releases/tag/1.20.4
https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584
https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205d
https://github.com/pluginsGLPI/fields/releases/tag/1.13.1
https://github.com/pluginsGLPI/fields/releases/tag/1.20.4
https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584