CVE-2024-23645

MEDIUM

GLPI 0.65-10.0.11 - Cross-Site Scripting via Reports Page URL

Title source: llm
STIX 2.1

Description

GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0089
EPSS Percentile 54.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
glpi-project/glpi 0.65 - 10.0.12
Published Feb 01, 2024
Tracked Since Feb 18, 2026