Medium severity · published Jun 28, 2022
CVE-2022-31068
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glpi · Glpi-project
10.0.0 before 10.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31068
Patch
https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5
Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-g4hm-6vfr-q3wg
More from Glpi
9.8
CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
9.8
CVE-2026-26263
GLPI has an Unauthenticated SQL Injection via Search engine
9.8
CVE-2025-66417
GLPI has an unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-24799
GLPI allows unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-21619
GLPI allows SQL injection through the rules configuration