📦

order

Vendor: glpi-project

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 0 Code Available
Total RCEs 1 Remote Access
Total CVEs 1 Total Indexed
Avg. EPSS 0.86% Exploit Prob.
Latest CVE CVE-2023-29006 Apr 05

Security Vulnerability Index

Page 1 / 1
8.8 CVSS
CVE-2023-29006
RCE

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin.

EPSS: 0.86%