CVE-2022-39277 MEDIUM

CVE-2022-39277: Cross-Site Scripting (XSS) in external links in GLPI

Vendor Glpi-Project

Product glpi

Weakness CWE-79 · XSS

Published November 3, 2022

Last update April 22, 2025

View on NVD All CVEs

CVSS base score

4.5/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to GLPI 10.0.4. There are currently no known workarounds.

Key dates

02Disclosure timeline

November 3, 2022 CVE published

April 22, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-39277 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-2800 WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name' CVE-2024-4723 Campcodes Legal Case Management System case-status cross site scripting CVE-2024-10895 Counter Up – Animated Number Counter & Milestone Showcase <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-59543 Chamilo: Account Takeover via Stored XSS in Course Description CVE-2024-43936 WordPress EmbedPress plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability