CVE-2022-35914 — Teclib GLPI Remote Code Execution Vulnerability

provenance: imported · CVE: CVE-2022-35914

CVE-2022-35914: Teclib GLPI Remote Code Execution Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Teclib
Product	GLPI
Date added	2023-03-07
Due date	2023-03-28
Ransomware campaign use	Unknown

Description

Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://glpi-project.org/fr/glpi-10-0-3-disponible/, http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed.; https://nvd.nist.gov/vuln/detail/CVE-2022-35914

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-35914
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog