Все бюллетени/c10f2/ALT-PU-2024-10302-2
ALT-PU-2024-10302-2

Обновление пакета phpipam в ветке c10f2

Версия1.6.0-alt1
Задание#353483
Опубликовано2024-07-30
Макс. серьёзностьHIGH
Серьёзность:

Закрытые проблемы (11)

BDU:2023-01781
HIGH7.2

Уязвимость сценария app/admin/custom-fields/edit-result.php веб-приложения для управления IP-адресами phpipam, позволяющая нарушителю выполнить произвольные SQL-команды

Опубликовано: 2023-04-02
CVSS 3.xВЫСОКАЯ 7.2
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C
Ссылки
BDU:2023-08030
HIGH7.5

Уязвимость компонента /users/ad-search-result.php веб-приложения для управления IP-адресами phpipam, позволяющая нарушителю раскрыть защищаемую информацию

Опубликовано: 2023-11-22
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N
Ссылки
CVE-2022-3845
MEDIUM6.1

A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 22c797c3583001211fe7d31bccd3f1d4aeeb3bbc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-212863.

Опубликовано: 2022-11-02Изменено: 2024-11-21
CVSS 3.xСРЕДНЯЯ 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Ссылки
CVE-2023-0676
MEDIUM6.1

Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.

Опубликовано: 2023-02-04Изменено: 2026-02-13
CVSS 3.xСРЕДНЯЯ 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Ссылки
CVE-2023-0677
MEDIUM6.1

Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.

Опубликовано: 2023-02-04Изменено: 2024-11-21
CVSS 3.xСРЕДНЯЯ 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Ссылки
CVE-2023-0678
MEDIUM5.3

Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.

Опубликовано: 2023-02-04Изменено: 2024-11-21
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2023-1211
HIGH7.2

SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.

Опубликовано: 2023-03-07Изменено: 2026-02-16
CVSS 3.xВЫСОКАЯ 7.2
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2023-1212
MEDIUM4.8

Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.

Опубликовано: 2023-03-07Изменено: 2024-11-21
CVSS 3.xСРЕДНЯЯ 4.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Ссылки
CVE-2023-41580
HIGH7.5

Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.

Опубликовано: 2023-10-02Изменено: 2024-11-21
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2023-4965
MEDIUM4.8

A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239732.

Опубликовано: 2023-09-14Изменено: 2024-11-21
CVSS 2.0НИЗКАЯ 3.3
CVSS:2.0/AV:N/AC:L/Au:M/C:N/I:P/A:N
CVSS 3.xСРЕДНЯЯ 4.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Ссылки