Remote inventory task command injection when using ssh command mode

CVE-2023-34254

What is CVE-2023-34254?

The GLPI Agent, utilized for system management, exhibits a command injection vulnerability in its remote inventory task on Unix systems. Administrators can inadvertently allow malicious users to inject commands in a specific workflow. If the agent operates with elevated privileges, attackers could exploit this flaw to gain unauthorized access and manipulate system functions. This vulnerability also exposes configuration data for all remote accesses used by the agent. The issue has been addressed in version 1.5 of the GLPI Agent, urging users to update promptly to mitigate risks.

References