Vulnerability · Published Dec 11, 2024 · Assigned by GitHub_M
CVE-2024-47758GLPI vulnerable to account takeover without privilege escalation through the API
High 7.6
In plain English
A high-severity improper access control in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 4.0)7.6High
Exploit odds (30 days)0.5%top 60.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| glpi-project | glpi | >= 9.3.0, < 10.0.17 |
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-3r4x-6pmx-phwr x_refsource_CONFIRM
- https://github.com/glpi-project/glpi/releases/tag/10.0.17 x_refsource_MISC