CVE-2022-39323: SQL Injection on REST API in GLPI

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 36.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-03 · updated 2026-06-17
Weakness: CWE-89

Description

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST user_token. This issue has been patched, please upgrade to version 10.0.4. As a workaround, disable login with user_token on API Rest.

Affected products

glpi-project glpi: from 9.1 before 10.0.4 — fixed in 10.0.4

How to fix

Upgrade to a fixed version: glpi-project glpi 10.0.4. Check the vendor advisory for mitigations.

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-cp6q-9p4x-8hr9
https://github.com/glpi-project/glpi/security/advisories/GHSA-cp6q-9p4x-8hr9

Get alerted when CVE-2022-39323 or the next vulnerability affects your stack