What’s Vulnerable › Vulnerabilities

CVE-2022-31068: Sensitive Data Exposure on Refused Inventory Files in GLPI

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-28 · updated 2026-06-17
• Weakness: CWE-200

Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.

Affected products

• glpi-project glpi: from 10.0.0 before 10.0.2 — fixed in 10.0.2

How to fix

Upgrade to a fixed version: glpi-project glpi 10.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5
• https://github.com/glpi-project/glpi/security/advisories/GHSA-g4hm-6vfr-q3wg
• https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5
• https://github.com/glpi-project/glpi/security/advisories/GHSA-g4hm-6vfr-q3wg

Get alerted when CVE-2022-31068 or the next vulnerability affects your stack