/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Affects GLPI versions below 10.0.3 and below 9.5.9 through the htmlawed module's test script. Fixed in GLPI 10.0.3 and 9.5.9.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 10.0.3, 9.5.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The htmlawed module used by GLPI (an IT asset and service management application) contains a test script that can be abused to inject and run arbitrary PHP code on the server. A successful attack could allow an attacker to execute commands and take control of the affected GLPI installation.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 7
bioinformatics.org
GitHub · glpi-project/glpi
glpi-project.org
packetstormsecurity.com
GitHub · Orange-Cyberdefense/CVE-repository
mayfly277.github.io
Questions about CVE-2022-35914
What does this mean?
The htmlawed test script htmLawedTest.php in GLPI allows PHP code injection. The advisory describes the impact as remote code execution without authentication.Source: github.com
Am I affected, and how do I check?
The advisory lists GLPI versions below 10.0.3 and below 9.5.9 as affected. The affected file is vendor/htmlawed/htmlawed/htmLawedTest.php within the GLPI installation, so check the GLPI version and whether that file is present.Source: github.com
What should I do about it?
Upgrade GLPI to 10.0.3 or 9.5.9, depending on the release line in use. The sources provided do not list a workaround.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-03-07, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data