CVE-2023-28855

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.

• CWE-269
• CWE-269

• https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205dPatch
• https://github.com/pluginsGLPI/fields/releases/tag/1.13.1Release Notes
• https://github.com/pluginsGLPI/fields/releases/tag/1.20.4Release Notes
• https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584Vendor Advisory
• https://github.com/pluginsGLPI/fields/commit/784260be7db185bb1e7d66b299997238c4c0205dPatch
• https://github.com/pluginsGLPI/fields/releases/tag/1.13.1Release Notes
• https://github.com/pluginsGLPI/fields/releases/tag/1.20.4Release Notes
• https://github.com/pluginsGLPI/fields/security/advisories/GHSA-52vv-hm4x-8584Vendor Advisory

Published

Apr 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2885Improper Enforcement of Message Integrity During Transmissio…8.1
• CVE-2023-28850Pimcore Perspective Editor provides an editor for Pimcore th…5.4
• CVE-2023-28851Silverstripe Form Capture provides a method to capture simpl…5.4
• CVE-2023-28852GLPI is a free asset and IT management software package. Sta…4.8
• CVE-2023-28853Mastodon is a free, open-source social network server based …6.5
• CVE-2023-28854nophp is a PHP web framework. Prior to version 0.0.1, nophp …8.8
• CVE-2023-28856Redis is an open source, in-memory database that persists on…6.5
• CVE-2023-28857Apereo CAS is an open source multilingual single sign-on sol…7.5
• CVE-2023-28858redis-py before 4.5.3 leaves a connection open after canceli…3.7
• CVE-2023-28859redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connec…6.5
• CVE-2023-2886Missing Origin Validation in WebSockets vulnerability in CBO…4.3
• CVE-2023-28862An issue was discovered in LemonLDAP::NG before 2.16.1. Weak…9.8