CVE-2023-28852: 
GLPI vulnerability analysis and mitigation

GLPI, a free asset and IT management software package, was found to contain a stored XSS vulnerability (CVE-2023-28852) affecting versions from 9.5.0 up to versions 9.5.13 and 10.0.7. The vulnerability was disclosed on April 5, 2023, and allows users with dashboard administration rights to inject malicious code that could be executed when other users access the affected dashboard (NIST NVD, GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The attack requires network access, has low attack complexity, requires high privileges, and needs user interaction. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NIST NVD).

The vulnerability allows dashboard administrators to store malicious code that can be executed when other users access the affected dashboard. This could lead to unauthorized access to sensitive information and potential manipulation of user data through cross-site scripting attacks (GitHub Advisory).

The vulnerability has been patched in GLPI versions 9.5.13 and 10.0.7. Users are strongly recommended to upgrade to these patched versions to protect against this security issue (GitHub Release, GitHub Release).