CVE Feed

    Dashboard / CVE / CVE-2023-28855

    CVE-2023-28855

    Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.

    Published:Apr 5, 2023
    Last Modified:Feb 10, 2025
    EPS:Apr 5, 2023
    EPSS Score:0.00129
    CVSS Score:6.5

    Affected Products

    Vendor
    Teclib-edition
    Product
    Fields

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High