CVE-2022-21720

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/glpi-project/glpi/commit/5c3eee696b503fdf502f506b00d15cf5b324b326Patch, Third Party Advisory
https://github.com/glpi-project/glpi/releases/tag/9.5.7Release Notes, Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-5hg4-r64r-rf83Mitigation, Third Party Advisory
https://github.com/glpi-project/glpi/commit/5c3eee696b503fdf502f506b00d15cf5b324b326Patch, Third Party Advisory
https://github.com/glpi-project/glpi/releases/tag/9.5.7Release Notes, Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-5hg4-r64r-rf83Mitigation, Third Party Advisory

Timeline

Published: Jan 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-217217.5Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a CVE-2022-217229.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217239.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217249.8pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security rese CVE-2022-217256.5Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a CVE-2022-217268.8Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and CVE-2022-217278.8Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer CVE-2022-217288.1Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate CVE-2022-217296.5Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a division by zero caused by CVE-2022-21736.1The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attr CVE-2022-217308.1Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalAvgPoolGrad` does not consider cases where the inp CVE-2022-217316.5Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denia