CVE-2024-45611

Description

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload to triggger a stored XSS. Upgrade to 10.0.17.

Reserved 2024-09-02 | Published 2024-11-15 | Updated 2024-11-19 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

>= 0.84, < 10.0.17
affected

References

github.com/...t/glpi/security/advisories/GHSA-j73h-x6j3-m479

cve.org (CVE-2024-45611)

nvd.nist.gov (CVE-2024-45611)

Download JSON