CVE-2022-39373: 
GLPI vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in GLPI versions 10.0.0 and above, identified as CVE-2022-39373. The vulnerability was found in the entity name functionality and was patched in version 10.0.4. This security issue was disclosed on November 3, 2022 (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 2.7 (Low severity) with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: High, User Interaction: None, Scope: Unchanged, Confidentiality: Low, Integrity: None, Availability: None. The vulnerability is classified as CWE-79, which refers to improper neutralization of input during web page generation (GitHub Advisory).

The vulnerability allows administrators to store malicious code in entity names, potentially leading to Cross-Site Scripting attacks. The impact is primarily limited to confidentiality with a low severity rating (GitHub Advisory).

The vulnerability requires high privileges to exploit, suggesting that only administrators can potentially store malicious code. While the attack complexity is low and requires no user interaction, the high privilege requirement significantly limits the potential for exploitation (GitHub Advisory).

The recommended mitigation is to upgrade to GLPI version 10.0.4 or later, which contains the patch for this vulnerability (GitHub Advisory).