hitoshura25/cvefixes huggingface dataset:
CVE-2020-15226 (PHP, published 2020-10-07T20:15Z)
Description: value: In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
inc/api/api.class.php
Commit message: Merge pull request from GHSA-jwpv-7m4h-5gvc

* Prevent SQL injection through search API

* better solution

Vulnerable code:
         $check_criteria = function($criteria) use (&$check_criteria, $soptions) {
            foreach ($criteria as $criterion) {

Fixed code:
         $check_criteria = function(&$criteria) use (&$check_criteria, $soptions) {
            foreach ($criteria as &$criterion) {

               // Escape value to prevent SQL injection
               $criterion['value'] = Toolbox::addslashes_deep($criterion['value']);
CVE-2021-21258 (PHP, published 2021-03-02T20:15Z)
Description: value: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
ajax/kanban.php
Commit message: Prevent XSS on Kanban


Vulnerable code:

Fixed code:
$_REQUEST = Toolbox::clean_cross_side_scripting_deep($_REQUEST);
CVE-2022-21719 (PHP, published 2022-01-28T10:15Z)
Description: value: GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
ajax/common.tabs.php
Commit message: Merge pull request from GHSA-6cj4-g839-gj5j



Vulnerable code:
   echo "<div class='center' id='debugajax'>";
   echo "<a href='".htmlentities($_SERVER['REQUEST_URI'])."' class='vsubmit'>Reload</a>";
   echo "</div>";


Fixed code:
CVE-2022-21720 (PHP, published 2022-01-28T11:15Z)
Description: value: GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
front/entity.form.php
Commit message: Merge pull request from GHSA-5hg4-r64r-rf83



Vulnerable code:
   $_POST['custom_css_code'] = $_UPOST['custom_css_code'];

Fixed code:
   // Prevent sanitize process to alter '<', '>' and '&' chars.
   $_POST['custom_css_code'] = $DB->escape($_UPOST['custom_css_code']);
CVE-2022-24867 (PHP, published 2022-04-21T17:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/Config.php
Commit message: Do not expose old ldap pass


Vulnerable code:
    public static $undisclosedFields      = ['proxy_passwd', 'smtp_passwd', 'glpinetwork_registration_key'];

Fixed code:
    public static $undisclosedFields      = [
        'proxy_passwd',
        'smtp_passwd',
        'glpinetwork_registration_key',
        'ldap_pass', // this one should not exist anymore, but may be present when admin restored config dump after migration
    ];
CVE-2022-24868 (PHP, published 2022-04-21T17:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user viewing the avatar will be subject to a cross site scripting attack. Users of GLPI are advised to upgrade. Users unable to upgrade should disallow SVG avatars.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/Document.php
src/User.php
Commit message: Merge pull request from GHSA-9hg4-fpwv-gx78



Vulnerable code:
                if (Toolbox::getMime($fullpath, 'image')) {
                    if (
                        Document::isImage($fullpath)
                        && Document::renameForce($fullpath, $picture_path)
                    ) {
                            __('Potential upload attack or file too large. Moving temporary file failed.'),

Fixed code:
            @unlink($fullpath);
                @unlink($fullpath);
                if (Document::isImage($fullpath, 'image')) {
                    if (Document::renameForce($fullpath, $picture_path)) {
                            __('Moving temporary file failed.'),
                        @unlink($fullpath);
                    @unlink($fullpath);
CVE-2022-24869 (PHP, published 2022-04-21T17:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack vector. This issue is partially mitigated by cors security of browsers, though users are still advised to upgrade.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/Toolbox.php
Commit message: Merge pull request from GHSA-p94c-8qp5-gfpx



Vulnerable code:
            'elements'         => '* -applet -canvas -embed -form -object -script',

Fixed code:
            'elements'         => '* -applet -canvas -embed -form -object -script -link',
CVE-2022-24876 (JavaScript, published 2022-06-09T19:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
js/modules/Kanban/Kanban.js
Commit message: Merge pull request from GHSA-33g2-m556-gccr



Vulnerable code:
                        ${l.attr('data-name') || `${member_itemtype} (${member_items_id})`}

Fixed code:
/* global escapeMarkupText */
                        ${escapeMarkupText(l.attr('data-name')) || `${member_itemtype} (${member_items_id})`}
CVE-2022-31061 (PHP, published 2022-06-28T18:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/Auth.php
Commit message: Merge pull request from GHSA-w2gc-v2gm-q7wq



Vulnerable code:
        } else if (strstr($login_auth, '-')) {
            $auths = explode('-', $login_auth);
            $this->user->fields["auths_id"] = $auths[1];
            if ($auths[0] == 'ldap') {
                $this->user->fields["authtype"] = self::LDAP;
            } else if ($auths[0] == 'mail') {
                $this->user->fields["authtype"] = self::MAIL;
            } else if ($auths[0] == 'external') {
                $this->user->fields["authtype"] = self::EXTERNAL;

Fixed code:
        } else if (preg_match('/^(?<type>ldap|mail|external)-(?<id>\d+)$/', $login_auth, $auth_matches)) {
            $this->user->fields["auths_id"] = (int)$auth_matches['id'];
            if ($auth_matches['type'] == 'ldap') {
            } else if ($auth_matches['type'] == 'mail') {
            } else if ($auth_matches['type'] == 'external') {
            $this->user->fields['authtype'] = $authtype;
CVE-2022-31068 (PHP, published 2022-06-28T18:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/glpi-project/glpi
Files changed:
front/inventory.php
Commit message: Merge pull request from GHSA-g4hm-6vfr-q3wg



Vulnerable code:

Fixed code:
    Session::checkRight("config", READ);
CVE-2022-31187 (PHP, published 2022-09-14T18:15Z)
Description: value: GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions were found to not properly neutralize HTML tags in the global search context. Users are advised to upgrade to version 10.0.3 to resolve this issue. Users unable to upgrade should disable global search.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/Search.php
Commit message: Fix handling of global search output


Vulnerable code:
                    if (self::$output_type == self::HTML_OUTPUT) {
                        self::$output_type != self::HTML_OUTPUT
                        self::$output_type != self::HTML_OUTPUT
                        self::$output_type != self::HTML_OUTPUT
                            $plaintext = RichText::getTextFromHtml($data[$ID][$k]['name'], false, true, self::$output_type == self::HTML_OUTPUT);

                            if (self::$output_type == self::HTML_OUTPUT && (Toolbox::strlen($plaintext) > $CFG_GLPI['cut'])) {

Fixed code:
        $html_output = in_array(
            self::$output_type,
            [
                self::HTML_OUTPUT,
                self::GLOBAL_SEARCH, // For a global search, output will be done in HTML context
            ]
        );

                    if ($html_output) {
                        !$html_output
                        !$html_output
                        !$html_output
                            $plaintext = RichText::getTextFromHtml($data[$ID][$k]['name'], false, true, $html_output);
                            if ($html_output && (Toolbox::strlen($plaintext) > $CFG_GLPI['cut'])) {
CVE-2022-35945 (PHP, published 2022-09-14T18:15Z)
Description: value: GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration page. They can be used to steal a GLPI administrator cookie. Users are advised to upgrade to 10.0.3. There are no known workarounds for this issue. ### Workarounds Do not use a registration key created by an untrusted person.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/GLPINetwork.php
Commit message: Escape GLPI-Network registration information


Vulnerable code:
                echo $informations['validation_message'];
            echo "<td>" . ($informations['subscription'] !== null ? $informations['subscription']['title'] : __('Unknown')) . "</td>";
            echo "<td>" . ($informations['owner'] !== null ? $informations['owner']['name'] : __('Unknown')) . "</td>";

Fixed code:
use Glpi\Toolbox\Sanitizer;
                echo Sanitizer::encodeHtmlSpecialChars($informations['validation_message']);
            echo "<td>" . ($informations['subscription'] !== null ? Sanitizer::encodeHtmlSpecialChars($informations['subscription']['title']) : __('Unknown')) . "</td>";
            echo "<td>" . ($informations['owner'] !== null ? Sanitizer::encodeHtmlSpecialChars($informations['owner']['name']) : __('Unknown')) . "</td>";
CVE-2022-35946 (PHP, published 2022-09-14T18:15Z)
Description: value: GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In affected versions request input is not properly validated in the plugin controller and can be used to access low-level API of Plugin class. An attacker can, for instance, alter database data. Attacker must have "General setup" update rights to be able to perform this attack. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should remove the `front/plugin.form.php` script.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
front/plugin.form.php
Commit message: Filter allowed methods in plugin form controller


Vulnerable code:
if (
    isset($_POST['action'])
    && isset($_POST['id'])
) {
    if (method_exists($plugin, $_POST['action'])) {
        call_user_func([$plugin, $_POST['action']], $_POST['id']);
    } else {
        echo "Action " . $_POST['action'] . " undefined";
    }
    Html::back();
Html::displayErrorAndDie('Lost');

Fixed code:
$id     = isset($_POST['id']) && is_numeric($_POST['id']) ? (int)$_POST['id'] : null;
$action = $id > 0 && isset($_POST['action']) ? $_POST['action'] : null;

switch ($action) {
    case 'install':
        $plugin->install($id);
        break;
    case 'activate':
        $plugin->activate($id);
        break;
    case 'unactivate':
        $plugin->unactivate($id);
        break;
    case 'uninstall':
        $plugin->uninstall($id);
        break;
    case 'clean':
        $plugin->clean($id);
        break;
    default:
        Html::displayErrorAndDie('Lost');
        break;
Html::back();
CVE-2022-35947 (PHP, published 2022-09-14T18:15Z)
Description: value: GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/User.php
tests/functionnal/User.php
Commit message: Ensure token based authentication only accept strings


Vulnerable code:
            function () use ($uid) {
                $this->testedInstance->getFromDBbyToken($uid, 'my_field');
         ->withType(E_USER_WARNING)
         ->withMessage('User::getFromDBbyToken() can only be called with $field parameter with theses values: \'personal_token\', \'api_token\'')
         ->exists();

Fixed code:
        if (!is_string($token)) {
            trigger_error(
                sprintf('Unexpected token value received: "string" expected, received "%s".', gettype($token)),
                E_USER_WARNING
            );
            return false;
        }

            function () {
                $this->testedInstance->getFromDBbyToken('1485dd60301311eda2610242ac12000249aef69a', 'my_field');
            ->withType(E_USER_WARNING)
            ->withMessage('User::getFromDBbyToken() can only be called with $field parameter with theses values: \'personal_token\', \'api_token\'')
            ->exists();

        $this->when(
            function () {
                $this->testedInstance->getFromDBbyToken(['REGEX', '.*'], 'api_token');
            }
        )->error()
            ->withType(E_USER_WARNING)
            ->withMessage('Unexpected token value received: "string" expected, received "array".')
            ->exists();
CVE-2023-28633 (PHP, published 2023-04-05T16:15Z)
Description: value: GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/glpi-project/glpi
Files changed:
CHANGELOG.md
src/RSSFeed.php
Commit message: Remove RSS feeds autodiscovery


Vulnerable code:
        if ($this->fields['have_error']) {
            echo "<td>" . __('RSS feeds found');
            echo "</td><td>";
            $this->showDiscoveredFeeds();
            echo "</td>\n";
        } else {
            echo "<td colspan='2'>&nbsp;</td>";
        }

Fixed code:
- `RSSFeed::showDiscoveredFeeds()`
        echo "<td colspan='2'>&nbsp;</td>";
     *
     * @deprecated
        Toolbox::deprecated();