CVE-2023-28855: 
NixOS vulnerability analysis and mitigation

CVE-2023-28855 affects the Fields plugin for GLPI, which allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, the vulnerability was identified as an improper privilege management issue that allowed any authenticated user to write data to any fields container, regardless of their configured access permissions (GitHub Advisory).

The vulnerability is classified as CWE-269 (Improper Privilege Management) with a CVSS v3.1 base score of 6.5 (Medium). The attack vector is Network-based (AV:N) with Low attack complexity (AC:L), requiring Low privileges (PR:L) and No user interaction (UI:N). The scope is Unchanged (S:U), with No impact on confidentiality (C:N), High impact on integrity (I:H), and No impact on availability (A:N) (GitHub Advisory).

The vulnerability allows authenticated users to write data to any fields container, including those to which they have no configured access. This represents a significant integrity breach as users can modify data in containers beyond their authorized access level (GitHub Advisory).

The vulnerability requires an authenticated user with low privileges to exploit. The attack complexity is low and can be executed remotely without requiring user interaction (GitHub Advisory).

The vulnerability has been patched in versions 1.13.1 and 1.20.4. Users are advised to upgrade to these patched versions to resolve the security issue (GitHub Release, GitHub Release).