Home

Description

GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.

PUBLISHED Reserved 2024-07-08 | Published 2024-11-15 | Updated 2024-11-19 | Assigner GitHub_M




HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

>= 0.85, < 10.0.17
affected

References

github.com/...t/glpi/security/advisories/GHSA-8843-r3m7-gfqx

cve.org (CVE-2024-40638)

nvd.nist.gov (CVE-2024-40638)

Download JSON