Vulnerability · Published Apr 21, 2022 · Assigned by GitHub_M

CVE-2022-24867LDAP password exposure in glpi

High 7.5

In plain English

A high-severity information exposure in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.3%top 29.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi	< 10.0.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e x_refsource_MISC