SSRF Vulnerability in GLPI Asset Management Software
CVE-2025-52567

5MEDIUM

Key Information:

Vendor

GLPI Project
Status
GLPI
Vendor
CVE Published:
30 July 2025

What is CVE-2025-52567?

In versions 0.84 through 10.0.18 of GLPI, a vulnerability exists that allows for Server-Side Request Forgery (SSRF) via the use of RSS feeds or external calendars during planning. The security fixes implemented in version 10.0.4 did not completely address specific exploit scenarios, leading to potential risks for users. Users are advised to upgrade to version 10.0.19, which includes a comprehensive patch to mitigate this vulnerability.

References

https://github.com/glpi-project/glpi/security/advisories/...

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.