Vulnerability · Published Apr 25, 2024 · Assigned by GitHub_M

CVE-2024-28241GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder

High 7.3

In plain English

A high-severity privilege mismanagement in glpi-agent from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.2%top 87.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which involves installed folder is automatically secured by the system.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi-agent	< 1.7.2

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-3268-p58w-86hw x_refsource_CONFIRM
https://github.com/glpi-project/glpi-agent/commit/9a97114f595562c91b0833b4a800dd51e9df65e9 x_refsource_MISC