Vulnerability · Published Dec 11, 2024 · Assigned by GitHub_M
CVE-2024-47761GLPI vulnerable to account takeover via the password reset feature
High 7.5
In plain English
A high-severity improper authentication in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 4.0)7.5High
Exploit odds (30 days)0.5%top 55.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| glpi-project | glpi | >= 0.80, < 10.0.17 |
Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-x794-564w-vgxx x_refsource_CONFIRM
- https://github.com/glpi-project/glpi/releases/tag/10.0.17 x_refsource_MISC