pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
vuln-list-alt/oval/p9/ALT-PU-2023-2081/definitions.json

273 lines
14 KiB
JSON
Raw Normal View History

ALT Vulnerability
2024-04-16 14:26:14 +00:00
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232081",
"Version": "oval:org.altlinux.errata:def:20232081",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2081: package `glpi` update to version 9.5.13-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p9"
],
"Products": [
"ALT Server",
"ALT Virtualization Server",
"ALT Workstation",
"ALT Workstation K",
"ALT Education",
"Simply Linux",
"Starterkit"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2081",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2081",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-03380",
"RefURL": "https://bdu.fstec.ru/vul/2023-03380",
"Source": "BDU"
},
{
"RefID": "BDU:2023-03381",
"RefURL": "https://bdu.fstec.ru/vul/2023-03381",
"Source": "BDU"
},
{
"RefID": "BDU:2023-03382",
"RefURL": "https://bdu.fstec.ru/vul/2023-03382",
"Source": "BDU"
},
{
"RefID": "BDU:2023-03385",
"RefURL": "https://bdu.fstec.ru/vul/2023-03385",
"Source": "BDU"
},
{
"RefID": "BDU:2023-03387",
"RefURL": "https://bdu.fstec.ru/vul/2023-03387",
"Source": "BDU"
},
{
"RefID": "BDU:2023-03388",
"RefURL": "https://bdu.fstec.ru/vul/2023-03388",
"Source": "BDU"
},
{
"RefID": "BDU:2023-03389",
"RefURL": "https://bdu.fstec.ru/vul/2023-03389",
"Source": "BDU"
},
{
"RefID": "CVE-2023-28632",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-28632",
"Source": "CVE"
},
{
"RefID": "CVE-2023-28633",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-28633",
"Source": "CVE"
},
{
"RefID": "CVE-2023-28634",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-28634",
"Source": "CVE"
},
{
"RefID": "CVE-2023-28636",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-28636",
"Source": "CVE"
},
{
"RefID": "CVE-2023-28639",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-28639",
"Source": "CVE"
},
{
"RefID": "CVE-2023-28838",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-28838",
"Source": "CVE"
},
{
"RefID": "CVE-2023-28852",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-28852",
"Source": "CVE"
}
],
"Description": "This update upgrades glpi to version 9.5.13-alt1. \nSecurity Fix(es):\n\n * BDU:2023-03380: Уязвимость системы работы с заявками и инцидентами GLPI, связанная с неправильной авторизацией, позволяющая нарушителю повышать привилегии внутри приложения\n\n * BDU:2023-03381: Уязвимость системы работы с заявками и инцидентами GLPI, связанная с неправильным управлением привилегиями, позволяющая нарушителю повышать привилегии внутри приложения\n\n * BDU:2023-03382: Уязвимость системы работы с заявками и инцидентами GLPI, связанная с подделкой запроса на стороне сервера, позволяющая нарушителю выполнять SSRF-атаки\n\n * BDU:2023-03385: Уязвимость системы работы с заявками и инцидентами GLPI, связанная с неправильной нейтрализацией ввода во время генерации веб-страницы, позволяющая нарушителю выполнять произвольные SQL-запросы в базе данных.\n\n * BDU:2023-03387: Уязвимость системы работы с заявками и инцидентами GLPI, связанная с неправильной нейтрализацией специальных элементов, используемых в команде SQL, позволяющая нарушителю выполнять произвольные SQL-запросы в базе данных\n\n * BDU:2023-03388: Уязвимость системы работы с заявками и инцидентами GLPI, связанная с неправильной нейтрализацией входных данных во время генерации веб-страницы, позволяющая нарушителю выполнять атаки с использованием межсайтовых сценариев\n\n * BDU:2023-03389: Уязвимость системы работы с заявками и инцидентами GLPI, связанная с неправильной нейтрализацией ввода во время генерации веб-страницы, позволяющая нарушителю выполнять атаки с использованием межсайтовых сценариев\n\n * CVE-2023-28632: GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the \"forgotten password\" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `Forgotten password?` event. However, it will not prevent unauthorized modification of any user emails.\n\n * CVE-2023-28633: GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.\n\n * CVE-2023-28634: GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin ac
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
ALT Vulnerability
2025-03-03 12:05:02 +00:00
"Rights": "Copyright 2025 BaseALT Ltd.",
ALT Vulnerability
2024-04-16 14:26:14 +00:00
"Issued": {
"Date": "2023-06-27"
},
"Updated": {
"Date": "2023-06-27"
},
"BDUs": [
{
"ID": "BDU:2023-03380",
"CVSS": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-285, CWE-863",
"Href": "https://bdu.fstec.ru/vul/2023-03380",
"Impact": "High",
"Public": "20230405"
},
{
"ID": "BDU:2023-03381",
"CVSS": "AV:N/AC:L/Au:S/C:C/I:C/A:N",
"CVSS3": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"CWE": "CWE-269",
"Href": "https://bdu.fstec.ru/vul/2023-03381",
"Impact": "High",
"Public": "20230405"
},
{
"ID": "BDU:2023-03382",
"CVSS": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"CWE": "CWE-918",
"Href": "https://bdu.fstec.ru/vul/2023-03382",
"Impact": "Low",
"Public": "20230405"
},
{
"ID": "BDU:2023-03385",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-79",
"Href": "https://bdu.fstec.ru/vul/2023-03385",
"Impact": "Low",
"Public": "20230405"
},
{
"ID": "BDU:2023-03387",
"CVSS": "AV:N/AC:L/Au:S/C:C/I:C/A:N",
"CVSS3": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"CWE": "CWE-89",
"Href": "https://bdu.fstec.ru/vul/2023-03387",
"Impact": "High",
"Public": "20230405"
},
{
"ID": "BDU:2023-03388",
"CVSS": "AV:N/AC:L/Au:M/C:P/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-79",
"Href": "https://bdu.fstec.ru/vul/2023-03388",
"Impact": "Low",
"Public": "20230405"
},
{
"ID": "BDU:2023-03389",
"CVSS": "AV:N/AC:L/Au:M/C:P/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-79",
"Href": "https://bdu.fstec.ru/vul/2023-03389",
"Impact": "Low",
"Public": "20230405"
}
],
"CVEs": [
{
"ID": "CVE-2023-28632",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-28632",
"Impact": "High",
"Public": "20230405"
},
{
"ID": "CVE-2023-28633",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-28633",
"Impact": "Low",
"Public": "20230405"
},
{
"ID": "CVE-2023-28634",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-28634",
"Impact": "High",
"Public": "20230405"
},
{
"ID": "CVE-2023-28636",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-28636",
"Impact": "Low",
"Public": "20230405"
},
{
"ID": "CVE-2023-28639",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-28639",
"Impact": "Low",
"Public": "20230405"
},
{
"ID": "CVE-2023-28838",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-28838",
"Impact": "High",
"Public": "20230405"
},
{
"ID": "CVE-2023-28852",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-28852",
"Impact": "Low",
"Public": "20230405"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:kworkstation:9",
"cpe:/o:alt:workstation:9",
"cpe:/o:alt:server:9",
"cpe:/o:alt:server-v:9",
"cpe:/o:alt:education:9",
"cpe:/o:alt:slinux:9",
ALT Vulnerability
2024-12-12 21:07:30 +00:00
"cpe:/o:alt:starterkit:p9"
ALT Vulnerability
2024-04-16 14:26:14 +00:00
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:1001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232081001",
"Comment": "glpi is earlier than 0:9.5.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232081002",
"Comment": "glpi-apache2 is earlier than 0:9.5.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232081003",
"Comment": "glpi-php7 is earlier than 0:9.5.13-alt1"
}
]
}
]
}
}
]
}
Reference in New Issue Copy Permalink