Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-27930

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.

Published

2024-03-18T16:15:08.453

Last Modified

2025-01-02T16:19:42.813

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-285
Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	glpi-project	glpi	< 10.0.13	Yes

References

https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html Exploit ([email protected])
https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e Patch ([email protected])
https://github.com/glpi-project/glpi/releases/tag/10.0.13 Release Notes ([email protected])
https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq Vendor Advisory ([email protected])
https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html Exploit (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/glpi-project/glpi/releases/tag/10.0.13 Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)