Vulnerability Name:

CVE-2013-2225 (CCN-85396)

Assigned:2013-07-01
Published:2013-07-01
Updated:2014-05-28
Summary:inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/ticket.form.php.
Per: http://cwe.mitre.org/data/definitions/502.html

"CWE-502: Deserialization of Untrusted Data"
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
4.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2013-2225

Source: OSVDB
Type: UNKNOWN
94683

Source: MLIST
Type: UNKNOWN
[oss-security] 20130627 CVE request for GLPI

Source: MLIST
Type: UNKNOWN
[oss-security] 20130630 Re: CVE request for GLPI

Source: EXPLOIT-DB
Type: Exploit
26530

Source: CCN
Type: GLPI Web site
GLPI

Source: BID
Type: UNKNOWN
60823

Source: CCN
Type: BID-60823
GLPI 'unserialize()' Function Remote PHP Code Execution Vulnerability

Source: XF
Type: UNKNOWN
glpi-ticketform-code-execution(85396)

Source: CONFIRM
Type: Exploit, Patch
https://forge.indepnet.net/projects/glpi/repository/revisions/21169/diff

Source: CCN
Type: Packet Storm Security [7-01-2013]
GLPI 0.83.9 Code Execution

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [07-01-2013]

Vulnerable Configuration:Configuration 1:
  • cpe:/a:glpi-project:glpi:0.5:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.5:rc1:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.5:rc2:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.6:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.6:rc1:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.6:rc2:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.6:rc3:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.20:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.21:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.30:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.31:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.40:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.41:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.42:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.51:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.51a:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.65:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.65:rc1:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.65:rc2:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.68:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.68:rc1:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.68:rc2:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.68:rc3:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.68.1:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.68.2:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.68.3:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.70:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.70:rc1:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.70:rc2:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.70:rc3:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.70.1:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.70.2:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.1:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.1:rc1:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.1:rc2:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.1:rc3:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.2:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.3:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.4:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.5:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.71.6:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.72:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.72:rc1:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.72:rc2:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.72:rc3:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.72.1:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.72.2:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.72.3:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.72.4:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.78:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.78.1:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.78.2:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.78.3:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.78.4:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.78.5:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80.1:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80.2:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80.3:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80.4:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80.5:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80.6:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80.7:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.80.61:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83.1:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83.2:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83.3:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83.4:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83.5:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83.6:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83.7:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:0.83.8:*:*:*:*:*:*:*
  • OR cpe:/a:glpi-project:glpi:*:*:*:*:*:*:*:* (Version <= 0.83.9)
  • OR cpe:/a:glpi-project:glpi:0.83.31:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.precise:def:20132225000
    V
    		CVE-2013-2225 on Ubuntu 12.04 LTS (precise) - medium.
    2014-05-27
    oval:com.ubuntu.trusty:def:20132225000
    V
    		CVE-2013-2225 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-05-27
    oval:com.ubuntu.xenial:def:20132225000
    V
    		CVE-2013-2225 on Ubuntu 16.04 LTS (xenial) - medium.
    2014-05-27
    oval:com.ubuntu.xenial:def:201322250000000
    V
    		CVE-2013-2225 on Ubuntu 16.04 LTS (xenial) - medium.
    2014-05-27
    BACK
    glpi-project glpi 0.5
    glpi-project glpi 0.5 rc1
    glpi-project glpi 0.5 rc2
    glpi-project glpi 0.6
    glpi-project glpi 0.6 rc1
    glpi-project glpi 0.6 rc2
    glpi-project glpi 0.6 rc3
    glpi-project glpi 0.20
    glpi-project glpi 0.21
    glpi-project glpi 0.30
    glpi-project glpi 0.31
    glpi-project glpi 0.40
    glpi-project glpi 0.41
    glpi-project glpi 0.42
    glpi-project glpi 0.51
    glpi-project glpi 0.51a
    glpi-project glpi 0.65
    glpi-project glpi 0.65 rc1
    glpi-project glpi 0.65 rc2
    glpi-project glpi 0.68
    glpi-project glpi 0.68 rc1
    glpi-project glpi 0.68 rc2
    glpi-project glpi 0.68 rc3
    glpi-project glpi 0.68.1
    glpi-project glpi 0.68.2
    glpi-project glpi 0.68.3
    glpi-project glpi 0.70
    glpi-project glpi 0.70 rc1
    glpi-project glpi 0.70 rc2
    glpi-project glpi 0.70 rc3
    glpi-project glpi 0.70.1
    glpi-project glpi 0.70.2
    glpi-project glpi 0.71
    glpi-project glpi 0.71.1
    glpi-project glpi 0.71.1 rc1
    glpi-project glpi 0.71.1 rc2
    glpi-project glpi 0.71.1 rc3
    glpi-project glpi 0.71.2
    glpi-project glpi 0.71.3
    glpi-project glpi 0.71.4
    glpi-project glpi 0.71.5
    glpi-project glpi 0.71.6
    glpi-project glpi 0.72
    glpi-project glpi 0.72 rc1
    glpi-project glpi 0.72 rc2
    glpi-project glpi 0.72 rc3
    glpi-project glpi 0.72.1
    glpi-project glpi 0.72.2
    glpi-project glpi 0.72.3
    glpi-project glpi 0.72.4
    glpi-project glpi 0.78
    glpi-project glpi 0.78.1
    glpi-project glpi 0.78.2
    glpi-project glpi 0.78.3
    glpi-project glpi 0.78.4
    glpi-project glpi 0.78.5
    glpi-project glpi 0.80
    glpi-project glpi 0.80.1
    glpi-project glpi 0.80.2
    glpi-project glpi 0.80.3
    glpi-project glpi 0.80.4
    glpi-project glpi 0.80.5
    glpi-project glpi 0.80.6
    glpi-project glpi 0.80.7
    glpi-project glpi 0.80.61
    glpi-project glpi 0.83
    glpi-project glpi 0.83.1
    glpi-project glpi 0.83.2
    glpi-project glpi 0.83.3
    glpi-project glpi 0.83.4
    glpi-project glpi 0.83.5
    glpi-project glpi 0.83.6
    glpi-project glpi 0.83.7
    glpi-project glpi 0.83.8
    glpi-project glpi *
    glpi-project glpi 0.83.31