GLPI Information Leakage Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

Account takeover via SQL Injection in UI layout preferences in GLPI

[email protected] reports: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL...

Account takeover via Kanban feature in GLPI

[email protected] reports: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to...

Users login enumeration by unauthenticated user in GLPI

[email protected] reports: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can enumerate users logins. Users are...

CVE-2023-42462

GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2023-42462, where the document upload process can divert to delete files. The initial entry recommends upgrading to version 10.0.10. Connected documents show multiple GLPI-related issues reported by PTSecurity (and related Nessus r...

CVE-2023-42462 File deletion through document upload process in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version...

CVE-2023-42461

GLPI (Gestionnaire Libre de Parc Informatique) has an SQL injection vulnerability (CVE-2023-42461) in the ticket/search path where the ITIL actor input field in the Ticket form can be exploited. This affects GLPI versions prior to 10.0.13; an authenticated user can abuse the vulnerable query, pot...

CVE-2023-41888 Phishing through a login page malicious URL in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The lack of path filtering on the GLPI URL may allow an attacker to transmit a malicious URL of login page...

CVE-2023-41888

CVE-2023-41888 concerns GLPI (Gestionnaire Libre de Parc Informatique). Multiple connected sources describe vulnerabilities in GLPI prior to fixed versions, including pre-10.13 and pre-10.0.13 lines, with various flaws (SQL injection, SSRF, XSS, unauthorized data access) that could enable informa...

CVE-2023-41326 Account takeover via Kanban feature in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with...

CVE-2023-41326

CVE-2023-41326 affects GLPI (Gestionnaire Libre de Parc Informatique). A logged-in user can hijack the Kanban feature to alter any user field, potentially leading to account compromise. The description recommends upgrading to GLPI version 10.0.10 to fix this issue; vendor advisories and related s...

CVE-2023-41324 Account takeover through API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised t...

CVE-2023-41324

GLPI (Gestionnaire Libre de Parc Informatique) vulnerability CVE-2023-41324 is evidenced in connected records as a SQL injection flaw in GLPI’s search functionality. Affected are GLPI versions prior to 10.0.13 (per PT Security entries); authenticated users can exploit the flaw to access or extrac...

CVE-2023-41324 Account takeover through API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised t...

CVE-2023-41323

CVE-2023-41323 affects GLPI (Gestionnaire Libre de Parc Informatique). An unauthenticated attacker can enumerate user logins, exposing usernames. Root cause: information disclosure enabling enumeration without authentication; impact is limited to confidentiality (usernames exposed) with no other ...

CVE-2023-41322

GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2023-41322. A user with write access to another user can request a password change and take control of that account, representing an authentication/authorization risk. The initial description recommends upgrading to version 10.0.10...

CVE-2023-41322 Privilege Escalation from technician to super-admin in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change the latter's password and then take...

CVE-2023-41321 Sensitive fields enumeration through API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user can enumerate sensitive fields values on resources on which he has read access. Users are...

CVE-2023-41321

GLPI (Gestionnaire Libre de Parc Informatique) prior to version 10.0.10 contains an API issue where an API user with read access can enumerate sensitive field values on resources. The vulnerability affects confidentiality (C) but has no impact on integrity/availability according to the provided d...

CVE-2023-41320

GLPI (Gestionnaire Libre de Parc Informatique) contains a SQL injection flaw in the search feature that affects versions prior to 10.0.13. An authenticated user can exploit the weakness to extract data or alter information, potentially taking control of an admin account. Remediation per connected...