Vulnerability · Published Feb 25, 2025 · Assigned by VulDB

CVE-2024-11955GLPI index.php redirect

Medium 4.3

In plain English

A medium-severity open redirect in GLPI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument redirect leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.0.18 is able to address this issue. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
n/a	GLPI	10.0.010.0.110.0.210.0.310.0.410.0.510.0.610.0.7

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

VDB-296809 | GLPI index.php redirect vdb-entry, technical-description
VDB-296809 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #451775 | GLPI-Project GLPI 10.0.17 Open Redirect third-party-advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-g5fm-jq4j-c2c7 related
https://github.com/glpi-project/glpi/releases/tag/10.0.18 patch