CVE-2023-28633

GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

• CWE-918

• https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982Patch
• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch, Release Notes
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch, Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwfVendor Advisory
• https://github.com/glpi-project/glpi/commit/e2819da64c9075050805a44c834e1f4dc621a982Patch
• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch, Release Notes
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch, Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-r57v-j88m-rwwfVendor Advisory

Published

Apr 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28628lambdaisland/uri is a pure Clojure/ClojureScript URI library…6.1
• CVE-2023-28629GoCD is an open source continuous delivery server. GoCD vers…5.4
• CVE-2023-2863A vulnerability has been found in Simple Design Daily Journa…5.5
• CVE-2023-28630GoCD is an open source continuous delivery server. In GoCD v…4.4
• CVE-2023-28631comrak is a CommonMark + GFM compatible Markdown parser and …9.8
• CVE-2023-28632GLPI is a free asset and IT management software package. Sta…8.1
• CVE-2023-28634GLPI is a free asset and IT management software package. Sta…8.8
• CVE-2023-28635vantage6 is privacy preserving federated learning infrastruc…5.4
• CVE-2023-28636GLPI is a free asset and IT management software package. Sta…4.8
• CVE-2023-28637DataEase is an open source data visualization analysis tool.…8.8
• CVE-2023-28638Snappier is a high performance C# implementation of the Snap…5.9
• CVE-2023-28639GLPI is a free asset and IT management software package. Sta…6.1