Lucene search

FreeBSD6091D1D8-4347-11EF-A4D4-080027957747

HistoryJun 03, 2024 - 12:00 a.m.

GLPI -- multiple vulnerabilities

2024-06-0300:00:00

vuxml.freebsd.org

glpi 10.0.16

multiple vulnerabilities

account takeover

sql injection

remote code execution

ajax scripts

plugin loader

authenticated file upload

restricted tickets

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

JSON

GLPI team reports:

GLPI 10.0.16 Changelog

[SECURITY - high] Account takeover via SQL Injection in AJAX scripts (CVE-2024-37148)
[SECURITY - high] Remote code execution through the plugin loader (CVE-2024-37149)
[SECURITY - moderate] Authenticated file upload to restricted tickets (CVE-2024-37147)

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchglpi< 10.0.16,1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	glpi	< 10.0.16,1	UNKNOWN

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37147

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37148

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37149

github.com/glpi-project/glpi/releases/tag/10.0.16

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

JSON

Related for 6091D1D8-4347-11EF-A4D4-080027957747