Lucene search
PRIOn knowledge basePRION:CVE-2023-28634HistoryApr 05, 2023 - 5:15 p.m.
Design/Logic Flaw
2023-04-0517:15:00
PRIOn knowledge base
www.prio-n.com
5
glpi
asset management
it management
privilege escalation
design flaw
logic flaw
technician profile
super-admin
hijack
patch
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
Related
cvelist
cvelist
osv
osv
CVE-2023-28634
2023-04-05 17:15:07
cve
cve
CVE-2023-28634
2023-04-05 17:15:07
ubuntucve
ubuntucve
CVE-2023-28634
2023-04-05 00:00:00
nvd
nvd
CVE-2023-28634
2023-04-05 17:15:07
freebsd
freebsd
glpi -- multiple vulnerabilities
2023-03-20 00:00:00
redos
redos
ROS-20230619-01
2023-06-19 00:00:00