CVE-2024-45600 | THREATINT

Description

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13.

Reserved 2024-09-02 | Published 2024-12-26 | Updated 2024-12-30 | Assigner GitHub_M

HIGH: 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

< 1.21.13

affected

References

github.com/...fields/security/advisories/GHSA-wwxw-64g6-2992

github.com/...ommit/eb927b0f084ee4ef6c87ab2eb7a15e99369e74ae

cve.org (CVE-2024-45600)

nvd.nist.gov (CVE-2024-45600)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.