CVE-2023-37278

    Dashboard / Vulnerabilities / CVE-2023-37278

    CVE-2023-37278

    Published: 13 Jul 2023Last Modified: 12 Aug 2026

    Summary: GLPI vulnerable to SQL injection via dashboard administration

    Details: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9.

    References: https://github.com/glpi-project/glpi/releases/tag/10.0.9, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37278.json, https://github.com/glpi-project/glpi/security/advisories/GHSA-46gp-f96h-53w4, https://nvd.nist.gov/vuln/detail/CVE-2023-37278

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9fa6de558a9987561b80afd57a796a3fa19deee6
    Fixed -48381dbb715dc0b92ffd789604b9cb2fd695e5b5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-37278 | CVE-DB