CVE-2023-28632

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-28632
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-28632.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-28632
Aliases
  • GHSA-7pwm-pg76-3q9x
Downstream
Published
2023-04-05T14:45:12.075Z
Modified
2025-11-29T14:11:14.632593Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
GLPI vulnerable to account takeover by authenticated user
Details

GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to Forgotten password? event. However, it will not prevent unauthorized modification of any user emails.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28632.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269"
    ]
}
References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
6e90eb69477f09e9e647eb31a05b32bad412f59e
Fixed
d110d2b6976208ca2cac0747cab92781b45475a7
Database specific 
{
    "versions": [
        {
            "introduced": "0.83"
        },
        {
            "fixed": "9.5.13"
        }
    ]
}
Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
815997021a5df4feb7077a12f6f52769e9bd3459
Fixed
bce21331d50a020cd0928178a68fe4aac2cc50b4
Database specific 
{
    "versions": [
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.7"
        }
    ]
}

Affected versions

10.*

10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.0.6