CVE-2022-21720 : What You Need to Know

GLPI is a free asset and IT management software package. An entity administrator could exploit a SQL injection vulnerability in GLPI prior to version 9.5.7, potentially accessing normally restricted data. Version 9.5.7 addresses this issue with a patch.

Understanding CVE-2022-21720

This CVE involves a SQL injection vulnerability in GLPI that allows unauthorized access to data.

What is CVE-2022-21720?

CVE-2022-21720 pertains to an SQL injection flaw in GLPI, enabling entity administrators to retrieve inaccessible data before version 9.5.7.

The Impact of CVE-2022-21720

The vulnerability poses a medium severity risk, with high confidentiality impact but no integrity impact. The attack complexity is low, requiring high privileges for exploitation.

Technical Details of CVE-2022-21720

The vulnerability allows entity administrators to exploit SQL injection, potentially compromising sensitive data.

Vulnerability Description

Prior to version 9.5.7, entity administrators can perform SQL injection attacks to access restricted data in GLPI.

Affected Systems and Versions

Entities using versions of GLPI before 9.5.7 are vulnerable to this issue.

Exploitation Mechanism

By leveraging SQL injection through custom CSS administration forms, entity administrators can bypass normal data access restrictions.

Mitigation and Prevention

Proactive measures can mitigate the risk posed by CVE-2022-21720.

Immediate Steps to Take

Upgrade GLPI to version 9.5.7 or later to patch the vulnerability. Alternatively, disabling the

Entities

update right can prevent exploitation.

Long-Term Security Practices

Regularly updating software and monitoring for security advisories can help prevent similar vulnerabilities in the future.

Patching and Updates

Stay informed about security updates for GLPI to apply patches promptly and enhance system security.