Hijacking vulnerability in GLPI asset management software

CVE-2024-37149

What is CVE-2024-37149?

GLPI is an open-source asset and IT management software that includes ITIL Service Desk features, license tracking, and software auditing capabilities. A vulnerability exists where an authenticated technician user can upload a malicious PHP script, thereby hijacking the plugin loader. This allows the executed script to run with the privileges of the authenticated user, posing significant risks to the integrity and security of the system. Users are advised to upgrade to version 10.0.16 to mitigate this vulnerability.

References