VYPR
← All advisories
High severity8.8NVD Advisory· Published Apr 5, 2023· Updated Jun 17, 2026

CVE-2023-29006

CVE-2023-29006

Description

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the ajax/dropdownContact.php file from the plugin.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Glpi Project/Order2 versions
    cpe:2.3:a:glpi-project:order:*:*:*:*:*:glpi:*:*+ 1 more
    • cpe:2.3:a:glpi-project:order:*:*:*:*:*:glpi:*:*range: >=1.8.0,<2.7.7
    • cpe:2.3:a:glpi-project:order:2.10.0:*:*:*:*:glpi:*:*
  • Glpi Project/Order GLPI pluginllm-create
    Range: >=1.8.0, <2.7.7 and <2.10.1
  • pluginsGLPI/orderv5
    Range: >= 1.8.0, < 2.7.7

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.