ALT-PU-2024-4884-1
Closed vulnerabilities
BDU:2024-02142
Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный SQL-код
BDU:2024-02268
Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Modified: 2025-01-02
CVE-2024-27096
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13.
- https://github.com/glpi-project/glpi/commit/61a0c2302b4f633f5065358adc36058e1abc37f9
- https://github.com/glpi-project/glpi/commit/61a0c2302b4f633f5065358adc36058e1abc37f9
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/security/advisories/GHSA-2x8m-vrcm-2jqv
- https://github.com/glpi-project/glpi/security/advisories/GHSA-2x8m-vrcm-2jqv
Modified: 2025-01-02
CVE-2024-27098
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.
- https://github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484
- https://github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w
- https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w
Modified: 2025-01-02
CVE-2024-27104
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.
- https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65
- https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj
- https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj
Modified: 2025-01-02
CVE-2024-27914
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.
- https://github.com/glpi-project/glpi/commit/69e0dee8de0c0df139b42dbfa1a8997888c2af95
- https://github.com/glpi-project/glpi/commit/69e0dee8de0c0df139b42dbfa1a8997888c2af95
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/security/advisories/GHSA-rcxj-fqr4-q34r
- https://github.com/glpi-project/glpi/security/advisories/GHSA-rcxj-fqr4-q34r
Modified: 2025-01-02
CVE-2024-27930
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.
- https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html
- https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html
- https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e
- https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq
- https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq
Modified: 2025-01-02
CVE-2024-27937
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.
- https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html
- https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html
- https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da
- https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj
- https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj