Vulnerability · Published Mar 18, 2024 · Assigned by GitHub_M
CVE-2024-27930Sensitive fields access through dropdowns in GLPI
Medium 6.5
In plain English
A medium-severity security flaw in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.1%top 33.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| glpi-project | glpi | >= 0.78, < 10.0.13 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq x_refsource_CONFIRM
- https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e x_refsource_MISC
- https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html x_refsource_MISC
- https://github.com/glpi-project/glpi/releases/tag/10.0.13 x_refsource_MISC