{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T05:34:43.206","vulnerabilities":[{"cve":{"id":"CVE-2022-39276","sourceIdentifier":"security-advisories@github.com","published":"2022-11-03T14:15:23.200","lastModified":"2026-06-17T04:58:03.230","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote script returns a redirect response, the redirect target URL is not checked against the URL allow list defined by administrator. This issue has been patched, please upgrade to 10.0.4. There are currently no known workarounds."},{"lang":"es","value":"GLPI significa Gestionnaire Libre de Parc Informatique. GLPI es un paquete gratuito de software de gestión de TI y activos que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. El uso de fuentes RSS o un calendario externo en la planificación está sujeto a explotación de la SSRF. En caso de que un script remoto devuelva una respuesta de redireccionamiento, la URL de destino de la redirección no se compara con la lista de URL permitidas definida por el administrador. Este problema ha sido solucionado; actualice a 10.0.4. Actualmente no se conocen workarounds."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"glpi-project","product":"glpi","versions":[{"version":"< 10.0.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-22T15:43:08.744306Z","id":"CVE-2022-39276","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.4","matchCriteriaId":"0E3788F7-1D17-4A55-AD12-A1899162909C"}]}]}],"references":[{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-8vwg-7x42-7v6p","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://huntr.dev/bounties/7a88f92b-1ee2-4ca8-9cf8-05fcf6cfe73f/","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-8vwg-7x42-7v6p","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://huntr.dev/bounties/7a88f92b-1ee2-4ca8-9cf8-05fcf6cfe73f/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}