CVE-2024-47758

Description

GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue.

Reserved 2024-09-30 | Published 2024-12-11 | Updated 2024-12-11 | Assigner GitHub_M

Problem types

CWE-284: Improper Access Control

Product status

>= 9.3.0, < 10.0.17
affected

References

github.com/...t/glpi/security/advisories/GHSA-3r4x-6pmx-phwr

github.com/glpi-project/glpi/releases/tag/10.0.17

cve.org (CVE-2024-47758)

nvd.nist.gov (CVE-2024-47758)

Download JSON