Skip to main content

Glpi CVE-2024-47758

HIGH
Improper Access Control (CWE-284)
2024-12-11 security-advisories@github.com
Authentication Bypass Glpi
7.6
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Dec 11, 2024 - 16:15 cve.org
HIGH 7.6

DescriptionCVE.org

GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue.

AnalysisAI

GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-284. GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue. Affected products include: Glpi-Project Glpi. Version information: version 9.3.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Glpi

View all
CVE-2013-5696 MEDIUM POC
6.8 Sep 23

inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installati
CVE-2025-24799 HIGH POC
7.5 Mar 18

GLPI IT asset management platform contains an unauthenticated SQL injection through the inventory endpoint. Attackers ca
CVE-2022-35914 CRITICAL POC
9.8 Sep 19

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. Rat
CVE-2022-31056 CRITICAL POC
9.8 Jun 28

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking an
CVE-2013-2225 MEDIUM POC
6.4 May 27

inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _pr
CVE-2024-27756 HIGH POC
8.8 Mar 15

GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. Rated high
CVE-2020-11060 HIGH POC
8.8 May 12

In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Rated high severity (
CVE-2019-14666 HIGH POC
8.8 Sep 25

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. Rated hig
CVE-2014-9258 MEDIUM POC
6.5 Dec 19

SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to exec
CVE-2024-29889 HIGH POC
8.1 May 07

GLPI is a Free Asset and IT Management Software package. Rated high severity (CVSS 8.1), this vulnerability is remotely

CVE-2013-2226 HIGH POC
7.5 May 14

Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands vi
CVE-2016-7508 HIGH POC
7.5 Jun 21

Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL co

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-47758 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy