CVE-2024-27937

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27937
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html Exploit
https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da Patch
https://github.com/glpi-project/glpi/releases/tag/10.0.13 Release Notes
https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj Vendor Advisory
https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html Exploit
https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da Patch
https://github.com/glpi-project/glpi/releases/tag/10.0.13 Release Notes
https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
History

02 Jan 2025, 16:20

Type Values Removed Values Added
First Time Glpi-project
Glpi-project glpi
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
References () https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html - () https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html - Exploit
References () https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da - () https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da - Patch
References () https://github.com/glpi-project/glpi/releases/tag/10.0.13 - () https://github.com/glpi-project/glpi/releases/tag/10.0.13 - Release Notes
References () https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj - () https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj - Vendor Advisory

21 Nov 2024, 09:05

Type Values Removed Values Added
References () https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html - () https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html -
References () https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da - () https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da -
References () https://github.com/glpi-project/glpi/releases/tag/10.0.13 - () https://github.com/glpi-project/glpi/releases/tag/10.0.13 -
References () https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj - () https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj -

24 Apr 2024, 15:15

Type Values Removed Values Added
Summary
  • (es) GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede obtener la dirección de correo electrónico de todos los usuarios de GLPI. Este problema se solucionó en la versión 10.0.13.
References
  • () https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html -

18 Mar 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-18 16:15

Updated : 2025-01-02 16:20

NVD link : CVE-2024-27937

Mitre link : CVE-2024-27937

CVE.ORG link : CVE-2024-27937

JSON object : View

Products Affected

glpi-project

  • glpi
CWE
CWE-285

Improper Authorization

NVD-CWE-noinfo