Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-48912

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue.

Published

2024-12-11T17:15:17.043

Last Modified

2025-01-10T19:37:41.063

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

Weaknesses

Type: Secondary
CWE-284
Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	glpi-project	glpi	< 10.0.17	Yes

References

https://github.com/glpi-project/glpi/releases/tag/10.0.17 Release Notes ([email protected])
https://github.com/glpi-project/glpi/security/advisories/GHSA-vjmw-j32j-ph4f Vendor Advisory ([email protected])