CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.
Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-09-25 20:15

Updated : 2024-02-04 20:39


NVD link : CVE-2019-14666

Mitre link : CVE-2019-14666

CVE.ORG link : CVE-2019-14666


JSON object : View

Products Affected

glpi-project

  • glpi
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor