Medium severity4.9NVD Advisory· Published Jan 28, 2022· Updated Jun 17, 2026
CVE-2022-21720
CVE-2022-21720
Description
GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the Entities update right prevents exploitation of this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3(expand)+ 2 more
- (no CPE)
- cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*range: <9.5.7
- (no CPE)range: <9.5.7
Patches
Vulnerability mechanics
References
3- github.com/glpi-project/glpi/commit/5c3eee696b503fdf502f506b00d15cf5b324b326nvdPatchThird Party Advisory
- github.com/glpi-project/glpi/releases/tag/9.5.7nvdRelease NotesThird Party Advisory
- github.com/glpi-project/glpi/security/advisories/GHSA-5hg4-r64r-rf83nvdMitigationThird Party Advisory
News mentions
0No linked articles in our index yet.