CVE-2024-50339 | THREATINT

Description

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

PUBLISHED Reserved 2024-10-22 | Published 2024-12-11 | Updated 2024-12-11 | Assigner GitHub_M

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-287: Improper Authentication

Product status

>= 9.5.0, < 10.0.17

affected

References

github.com/...t/glpi/security/advisories/GHSA-v977-g4r9-6r72

github.com/glpi-project/glpi/releases/tag/10.0.17

cve.org (CVE-2024-50339)

nvd.nist.gov (CVE-2024-50339)

Download JSON