CVE-2022-39371: 
GLPI vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in GLPI versions 10.0.0 and above, identified as CVE-2022-39371. The vulnerability was disclosed on November 3, 2022, and affects the asset inventory functionality where script-related HTML tags were not properly neutralized (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High severity). The attack vector is Network-based with Low attack complexity, requiring No privileges and No user interaction. The scope is Unchanged, with High impact on Confidentiality but No impact on Integrity and Availability. The technical vulnerability is classified under CWE-80 (GitHub Advisory).

The vulnerability allows attackers to execute malicious scripts through the asset inventory system, potentially compromising the confidentiality of data. The high confidentiality impact indicates that sensitive information could be exposed to unauthorized users (GitHub Advisory).

The vulnerability has been patched in GLPI version 10.0.4. Users are advised to upgrade to this version to mitigate the risk. For additional security concerns, users can contact the GLPI security team at glpi-security@ow2.org (GitHub Advisory).