Vulnerability · Published Mar 18, 2024 · Assigned by GitHub_M
CVE-2024-27937glpi Users emails enumeration
Medium 6.5
In plain English
A medium-severity security flaw in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 27.1% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)27.1%top 1.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| glpi-project | glpi | >= 10.0.0, < 10.0.13 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj x_refsource_CONFIRM
- https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da x_refsource_MISC
- https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html x_refsource_MISC
- https://github.com/glpi-project/glpi/releases/tag/10.0.13 x_refsource_MISC