CVE-2024-45600

Description

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13.

PUBLISHED Reserved 2024-09-02 | Published 2024-12-26 | Updated 2024-12-30 | Assigner GitHub_M

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

References

github.com/...fields/security/advisories/GHSA-wwxw-64g6-2992

github.com/...ommit/eb927b0f084ee4ef6c87ab2eb7a15e99369e74ae

cve.org (CVE-2024-45600)

nvd.nist.gov (CVE-2024-45600)

Download JSON