Security readout for executives and security teams
Plain-English summary
GLPI 10.0.0 and 10.0.1 can expose sensitive information when native inventory is used because a refused-inventory-file feature lacks authentication. The issue is remotely reachable and requires no login, but the documented impact is limited to confidentiality. The vendor fixed it in GLPI 10.0.2.
Executive priority
Treat this as a moderate-priority remediation for GLPI environments. Prioritize internet-facing or shared-service GLPI deployments using native inventory. The issue is not described as destructive, but unauthenticated data exposure can create follow-on business risk if inventory details or secrets were disclosed.
Technical view
CVE-2022-31068 is a CWE-200 sensitive data exposure in glpi-project GLPI versions >=10.0.0 and <10.0.2. The native inventory refused-file retrieval feature was unauthenticated, allowing network-based unauthenticated access to information that should not be public. CVSS 3.1 is 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Likely exposure
Exposure is most likely where GLPI 10.0.0 or 10.0.1 is deployed with native inventory enabled, especially on internet-facing or broadly reachable portals. Instances not using native inventory are less clearly affected based on the provided sources.
Exploitation context
The source bundle does not identify active exploitation, and KEV is false. The flaw is still easy to reach in principle because it is network-accessible, unauthenticated, and needs no user interaction. Expected attacker value depends on what sensitive data exists in refused inventory files.
Researcher notes
The provided evidence supports affected GLPI versions, unauthenticated access to refused inventory files, CWE-200, and a 10.0.2 fix. It does not include endpoint details, proof of exploitation, or confirmed exploit tooling. Avoid assuming broader GLPI versions or non-native-inventory deployments are affected without vendor confirmation.
Mitigation direction
- Upgrade affected GLPI instances to version 10.0.2 or later.
- Check the GLPI advisory for any environment-specific guidance.
- Restrict network access to GLPI until affected systems are upgraded.
- Review refused inventory data for sensitive information exposure.
- Rotate or invalidate secrets if logs or files show disclosure.
Validation and detection
- Inventory all GLPI deployments and record exact versions.
- Confirm whether native inventory is enabled on each instance.
- Verify affected systems are upgraded to GLPI 10.0.2 or later.
- Review access logs for unauthenticated refused-file retrieval activity.
- Assess whether exposed inventory files contained sensitive data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31068 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/glpi-project/glpi/security/advisories/GHSA-g4hm-6vfr-q3wgCVE reference · x_refsource_CONFIRM
- https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.