CVE-2024-40638 | THREATINT

Description

GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.

Reserved 2024-07-08 | Published 2024-11-15 | Updated 2024-11-19 | Assigner GitHub_M

HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

>= 0.85, < 10.0.17

affected

References

github.com/...t/glpi/security/advisories/GHSA-8843-r3m7-gfqx

cve.org (CVE-2024-40638)

nvd.nist.gov (CVE-2024-40638)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.