CVE-2024-47760 | THREATINT

Description

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.

Reserved 2024-09-30 | Published 2024-12-11 | Updated 2024-12-11 | Assigner GitHub_M

HIGH: 7.5CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-284: Improper Access Control

Product status

>= 9.1.0, < 10.0.17

affected

References

github.com/...t/glpi/security/advisories/GHSA-r3mx-fr5f-gwgp

github.com/glpi-project/glpi/releases/tag/10.0.17

cve.org (CVE-2024-47760)

nvd.nist.gov (CVE-2024-47760)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.