Fields GLPI plugin has an Authenticated SQL Injection
Priority LOW 34CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Fix Fixed fields (pluginsGLPI): 1.21.13
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pluginsGLPI | fields | before 1.21.13 | 1.21.13 | Patch available | CNA |
- fields VendorpluginsGLPI Affected before 1.21.13 Fixed in 1.21.13 Patch available CNA
Remediation
- Fix · CNA fields (pluginsGLPI) Fixed in 1.21.13
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45600
References
More pluginsGLPI vulnerabilities
- TI-2024-36046 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation CVSS 3.1HIGH 8.2
- TI-2026-38943 Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering CVSS 4.0HIGH 7.3
- TI-2025-20010 Escalade GLPI Plugin Vulnerable to Improper Access Control CVSS 3.1MEDIUM 6.5
- TI-2026-09772 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import CVSS 4.0HIGH 7.1
- TI-2025-40221 GLPI Database Inventory Plugin Vulnerable to Stored Object Injection CVSS 3.1MEDIUM 6.4
- TI-2025-33324 pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests CVSS 3.1MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences