CVE-2022-31056 CRITICAL

CVE-2022-31056: SQL injection with _actor parameter in GLPI

Vendor Glpi-Project
Product glpi
Weakness CWE-89 · SQLi
Published June 28, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.

Key dates

02Disclosure timeline

June 28, 2022 CVE published
April 23, 2025 Record updated