CVE-2026-23489

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23489", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T15:47:41.628Z", "datePublished": "2026-03-16T17:12:43.964Z", "dateUpdated": "2026-03-16T17:51:31.011Z"}, "containers": {"cna": {"title": "Fields GLPI plugin vulnerable to RCE in dropdown generation", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7"}, {"name": "https://github.com/pluginsGLPI/fields/releases/tag/1.23.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/pluginsGLPI/fields/releases/tag/1.23.3"}], "affected": [{"vendor": "pluginsGLPI", "product": "fields", "versions": [{"version": "< 1.23.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-16T17:12:43.964Z"}, "descriptions": [{"lang": "en", "value": "Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3."}], "source": {"advisory": "GHSA-rj7q-mmx9-fhq7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T17:46:27.792352Z", "id": "CVE-2026-23489", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T17:51:31.011Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23489", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T15:47:41.628Z", "datePublished": "2026-03-16T17:12:43.964Z", "dateUpdated": "2026-03-16T17:51:31.011Z"}, "containers": {"cna": {"title": "Fields GLPI plugin vulnerable to RCE in dropdown generation", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7"}, {"name": "https://github.com/pluginsGLPI/fields/releases/tag/1.23.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/pluginsGLPI/fields/releases/tag/1.23.3"}], "affected": [{"vendor": "pluginsGLPI", "product": "fields", "versions": [{"version": "< 1.23.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-16T17:12:43.964Z"}, "descriptions": [{"lang": "en", "value": "Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3."}], "source": {"advisory": "GHSA-rj7q-mmx9-fhq7", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23489", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T17:46:27.792352Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T17:46:44.588Z"}}]}}

{"affected": [{"affectedData": [{"product": "fields", "vendor": "pluginsGLPI", "versions": [{"status": "affected", "version": "< 1.23.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:teclib-edition:fields:*:*:*:*:*:glpi:*:*", "matchCriteriaId": "D8D41280-4949-46CA-94DE-B0A44A836D0E", "versionEndExcluding": "1.23.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3."}, {"lang": "es", "value": "Fields es un plugin de GLPI que permite a los usuarios a\u00f1adir campos personalizados en los formularios de elementos de GLPI. Antes de la versi\u00f3n 1.23.3, es posible ejecutar c\u00f3digo PHP arbitrario por parte de usuarios que tienen permiso para crear desplegables. Este problema ha sido parcheado en la versi\u00f3n 1.23.3."}], "id": "CVE-2026-23489", "lastModified": "2026-06-17T10:21:40.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23489", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T17:46:27.792352Z", "version": "2.0.3"}}]}, "published": "2026-03-16T18:16:06.800", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/pluginsGLPI/fields/releases/tag/1.23.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.23.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "fields", "source": "cna", "vendor": "pluginsGLPI"}, "product": "fields", "vendor": "pluginsglpi"}], "analysis": {"en": {"generated_at": "2026-03-18T15:27:05.106109+00:00", "value": {"mitigation_remediation": ["Upgrade the GLPI Fields plugin to version 1.23.3 or later to patch the vulnerability.", "Restrict permissions to create dropdowns to trusted administrators only.", "Verify the GLPI configuration to ensure untrusted users cannot create custom fields.", "Monitor system logs for suspicious dropdown creation activity."], "summary": {"action": "Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the GLPI Fields plugin version 1.23.2 and earlier. Any instance of the plugin used before the 1.23.3 release is susceptible.", "description_and_impact": "Fields is a GLPI plugin used to add custom fields to GLPI item forms. This vulnerability allows an attacker with permission to create dropdowns to execute arbitrary PHP code on the GLPI server. As a result, the attacker can gain full control of the GLPI instance, compromising confidentiality, integrity, and availability. The weakness is an input validation flaw (CWE-20).", "risk_and_exploitability": "The CVSS score of 9.1 indicates a high severity Remote Code Execution capability. The EPSS score of <1% suggests that public exploitation is currently uncommon but still possible. The vulnerability is not listed in the CISA KEV collection. An attacker would need permission to create dropdowns in the plugin, which is typically restricted to administrators or trusted users. Once authorized, the attacker can supply malicious input during dropdown creation to trigger code execution."}}}}, "created": "2026-03-17T09:52:29.024381+00:00", "updated": "2026-03-24T10:50:09.489004+00:00", "vendors": ["pluginsglpi", "pluginsglpi$PRODUCT$fields"]}