CVE-2023-36808

GLPI vulnerable to SQL injection through Computer Virtual Machine information

Exploitation likely. EPSS gives it a 52% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.18.6High EPSS percentile99th52% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2023-07-05Updated 2024-11-21Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Glpi-project GlpiAffected: >= 0.80, < 10.0.8Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of GLPI you are running — anything from 0.80 up to just before 10.0.8 is affected.
If you manage GLPI yourself, upgrade to version 10.0.8 or later as soon as possible.
If a vendor or IT provider manages GLPI for you, ask them directly whether your instance has been patched.
If you can't upgrade immediately, disable native inventory as a temporary measure.
After upgrading, confirm the version shown in GLPI matches 10.0.8 or higher.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.

In plain language

Written by AI from the record

GLPI, a popular IT asset management tool, has a serious flaw that lets an outsider tamper with its database without even logging in — if you run GLPI, this needs attention soon, and the fix is version 10.0.8 or later.

Unauthenticated SQL injection in GLPI's Computer Virtual Machine form and inventory request handling (CWE-89) allows remote attackers to manipulate database queries without any credentials, fixed in 10.0.8.

If you're affected

IT asset database exposure
Unauthorized data extraction
Operational disruption
Compliance/audit risk

What is it

GLPI is software businesses use to keep track of computers, servers, and IT equipment. This flaw is like leaving a side door unlocked that lets a stranger walk straight into the filing cabinet where that equipment data is stored — no key or login required. They could read, alter, or damage records without anyone needing to click anything or enter a password.

Who is affected

This matters to you if you run GLPI for IT asset or inventory management, specifically any version from 0.80 up to versions before 10.0.8. The vulnerable feature (native inventory and virtual machine tracking) is typically enabled by default, so if your GLPI server is reachable over the network, it is likely exposed without any further conditions needed.

How urgent is it

No confirmed real-world attacks have been reported yet, and this is not on any government list of actively exploited flaws, but the flaw is easy to trigger since it needs no login, and public interest in it is growing. Treat this as a priority to fix in the near term rather than an emergency to drop everything for right now.

What to do — in detail

Identify all GLPI instances in your environment and determine their exact version (vulnerable range: 0.80 through pre-10.0.8). 2. Upgrade to GLPI 10.0.8 or later, following the vendor's standard upgrade path; review the GHSA-vf5h-jh9q-2gjm advisory for any breaking changes between major versions before upgrading across multiple major releases. 3. If immediate patching isn't feasible, disable native inventory as an interim workaround, since this is the vector through which the Computer Virtual Machine form/inventory request SQL injection is triggered. 4. After patching, monitor application and database logs for anomalous queries targeting the virtual machine/inventory endpoints, and review recent inventory submission logs for signs of prior exploitation attempts. 5. No CISA KEV deadline currently applies since this CVE is not listed in KEV.

Technical context

CVSS 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects unauthenticated, network-exploitable SQL injection (CWE-89) with high confidentiality impact and scope change, no integrity/availability impact. No public exploit code is currently on record and the vulnerability is not in CISA's KEV catalog, indicating exploitation has not been confirmed in the wild, though EPSS places predicted exploitation likelihood in a notably high percentile with a rising trend, and press attention is increasing — exploit maturity should be considered emerging rather than active.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

52% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 1188 days, from the signal feeds we watch.

2026-10-05EPSS band changemoderate → highepss band change
2026-06-25OpenVAS check added
2024-11-21Patch availablerecord updated
2023-07-05Publishedweakness classified, att&ck mapped

Affected products

glpi-projectoss-project · FR
- glpiWeb AppOn-premEnterprise Software / itsm-monitoring
GLPI Projectoss-project · FRaka glpi inventory, glpi
- GLPIWeb AppOn-premEnterprise Software / itsm-monitoring

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Scored 8.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact