CVE-2023-35939 GLPI vulnerable to unauthorized access to Dashboard data

What is CVE-2023-35939?

CVE-2023-35939 is a high-severity vulnerability in Glpi-Project Glpi, published on 5 Jul 2023.

Official description

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8 contains a patch for this issue.

Weakness: CWE-863, CWE-284

Which versions are affected by CVE-2023-35939?

It affects 1 product.

Products include Glpi-Project Glpi.

How do I fix CVE-2023-35939?

No fix has been published for CVE-2023-35939 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-35939 being exploited?

There is no known exploitation of CVE-2023-35939 in the wild and no public exploit code.

Other vulnerabilities in Glpi-Project Glpi

• CVE-2022-35914 Teclib GLPI Remote Code Execution Exploited Critical 9.8
• CVE-2023-42802 GLPI vulnerable to unallowed PHP script execution Critical 10.0
• CVE-2023-28849 GLPI vulnerable to SQL injection and Stored XSS via inventory agent request Critical 10.0
• CVE-2022-35947 SQL injection in GLPI Critical 10.0
• CVE-2022-31056 SQL injection with _actor parameter in GLPI Critical 9.8

All Glpi-Project Glpi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cjcx-pwcx-v34c, UBUNTU-CVE-2023-35939.