CVE-2022-39276: 
GLPI vulnerability analysis and mitigation

GLPI (Gestionnaire Libre de Parc Informatique), a Free Asset and IT Management Software package that provides ITIL Service Desk features, was found to contain a Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2022-39276. The vulnerability was discovered in the RSS feeds and external calendar functionality within the planning feature. The issue was disclosed on November 3, 2022, affecting versions prior to 10.0.4 (GitHub Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). When a remote script returns a redirect response, the redirect target URL is not properly validated against the URL allow list defined by the administrator. The vulnerability has been assigned a CVSS v3.1 score of 3.5 (Low severity) with the following base metrics: Attack Vector: Network, Attack Complexity: High, Privileges Required: Low, User Interaction: None, Scope: Changed, Confidentiality: Low, Integrity: None, Availability: None (GitHub Advisory).

The vulnerability primarily affects the confidentiality aspect of the system, with a low impact rating. The SSRF vulnerability could potentially allow an attacker to bypass URL restrictions and access unauthorized resources through redirect responses (GitHub Advisory).

The exploit requires network access and low privileges, though it has high attack complexity. No user interaction is needed to exploit the vulnerability, but the attacker must have sufficient privileges to access the RSS feeds or external calendar functionality (GitHub Advisory).

The vulnerability has been patched in GLPI version 10.0.4. Users are advised to upgrade to this version or later to address the security issue. No known workarounds were available for this vulnerability (GitHub Advisory).