CVE-2022-39376

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-39376

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-39376.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-39376

Aliases

GHSA-6rh5-m5g7-327w

Downstream

UBUNTU-CVE-2022-39376

Published

2022-11-03T00:00:00Z

Modified

2025-11-28T04:55:27.643121Z

Severity

2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Improper input validation on emails links in GLPI

Details

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in mailto links. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39376.json",
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type: GIT
Repo: https://github.com/glpi-project/glpi
Events: Introduced

5078f4a5f74b06f044a0f9a48352053b3a60ca38

Fixed

7a9752f4d66351268cb25908f2bb2b94fbc0608c