CVE-2023-35939
GLPI vulnerable to unauthorized access to Dashboard data
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
GLPI vulnerable to unauthorized access to Dashboard data
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8 contains a patch for this issue.
Reserved 2023-06-20 | Published 2023-07-05 | Updated 2024-10-18 | Assigner GitHub_MCWE-284: Improper Access Control
CWE-863: Incorrect Authorization
github.com/...t/glpi/security/advisories/GHSA-cjcx-pwcx-v34c
github.com/glpi-project/glpi/releases/tag/10.0.8
Support options
