Vulnerability · Published Nov 18, 2024 · Assigned by GitHub_M
CVE-2024-43416GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
High 7.5
In plain English
A high-severity information exposure in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.2%top 31.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| glpi-project | glpi | >= 0.80, < 10.0.17 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N