Vulnerability · Published Sep 26, 2023 · Assigned by GitHub_M

CVE-2023-41326Account takeover via Kanban feature in GLPI

High 8.1

In plain English

A high-severity privilege mismanagement in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 36.5% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)36.5%top 1.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with stealing its account. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi	>= 9.5.0, < 10.0.10

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-5wj6-hp4c-j5q9 x_refsource_CONFIRM