Vulnerability · Published Jan 5, 2022 · Assigned by GitHub_M

CVE-2021-43779Remote Command Execution vulnerability

Critical 9.9

In plain English

A critical-severity improper input validation in addressing from pluginsGLPI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 9.1% (higher than 95% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)9.1%top 4.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.

Affected products (as reported)

Vendor	Product	Versions
pluginsGLPI	addressing	< 2.9.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

References

https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh x_refsource_CONFIRM
https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366 x_refsource_MISC
https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin x_refsource_MISC
https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779