CVE-2022-31187: 
GLPI vulnerability analysis and mitigation

CVE-2022-31187 is a stored XSS vulnerability affecting GLPI versions 10.0.0 through versions prior to 10.0.3. The vulnerability was discovered and disclosed on September 14, 2022, affecting the global search functionality in GLPI software (GitHub Advisory).

The vulnerability stems from improper neutralization of HTML tags in the global search context. Script-related HTML tags in the global search functionality are not properly sanitized, allowing for potential script injection. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Moderate), with attack vector being Network, attack complexity Low, requiring Low privileges, and no user interaction needed (GitHub Advisory).

The vulnerability primarily affects the availability of the system, with no direct impact on confidentiality or integrity according to the CVSS metrics. The successful exploitation could potentially lead to script execution in the context of the global search functionality (GitHub Advisory).

The vulnerability requires low privileges and network access to exploit, with no user interaction necessary. The attack complexity is rated as low, making it relatively straightforward to exploit for attackers with the required access (GitHub Advisory).

The primary mitigation is to upgrade to GLPI version 10.0.3 or later, which contains the fix for this vulnerability. As a temporary workaround, administrators can disable the global search functionality if immediate upgrading is not possible (GitHub Advisory).