Security readout for executives and security teams
Plain-English summary
GLPI versions before 10.0.1 allow a logged-in user to inject SQL through search pages. This can threaten sensitive asset, service desk, license, and audit data because the CVSS vector rates confidentiality and integrity impact as high. It is not listed as CISA KEV in the provided bundle.
Executive priority
Prioritize remediation for production GLPI systems because the flaw can affect business-critical IT asset and service desk data. Authenticated access is required, but compromised or low-privilege accounts could still create material data integrity and confidentiality risk.
Technical view
CVE-2022-29250 is CWE-89 SQL injection in glpi-project GLPI before 10.0.1. Attack complexity is low, network reachable, requires low privileges, and needs no user interaction. The provided CVSS 3.1 score is 8.1 with high confidentiality and integrity impact and no availability impact.
Likely exposure
Organizations running GLPI below 10.0.1 are exposed, especially where many users can log in or the application is internet-accessible. The issue requires authenticated access, so anonymous exposure is not supported by the provided sources.
Exploitation context
The source bundle states exploitation requires a logged-in user. It does not provide evidence of public exploitation, and KEV is false. Treat this as a serious insider, compromised-account, or low-privilege-user escalation risk rather than confirmed active mass exploitation.
Researcher notes
Evidence is limited to the CVE data and GitHub advisory reference in the bundle. No exploit details, indicators, or alternate affected products are provided. Validation should focus on versioning, exposure, account scope, and monitoring rather than reproduction of SQL injection behavior.
Mitigation direction
- Upgrade GLPI to version 10.0.1 or later.
- Check the GitHub advisory for any vendor-specific upgrade guidance.
- Limit GLPI access to trusted networks where practical.
- Review and reduce unnecessary GLPI user accounts and privileges.
Validation and detection
- Inventory all GLPI instances and record their versions.
- Flag any GLPI deployment running below 10.0.1.
- Confirm whether GLPI login is exposed externally.
- Review application and database logs for unusual authenticated search activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-29250 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvwCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.