Security Vulnerability in IT Management Software Package
CVE-2024-47760

8.8HIGH

Key Information:

Vendor
Glpi-project
Status
Glpi
Vendor
CVE Published:
11 December 2024

Summary

GLPI, an open-source asset and IT management software, has a vulnerability that allows a technician with API access to gain control over accounts with elevated privileges. This occurs in versions 9.1.0 through 10.0.16, posing a significant security risk. The issue has been remedied in version 10.0.17, which includes necessary patches to mitigate the threat.

Affected Version(s)

glpi >= 9.1.0, < 10.0.17

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM
https://github.com/glpi-project/glpi/releases/tag/10.0.17
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.