CVE-2024-28241

The CVE-2024-28241 entry concerns GLPI Agent. Before version 1.7.2, a local user can modify GLPI-Agent code or DLLs to alter agent logic and gain higher privileges. A patch is available in GLPI-Agent 1.7.2; as a workaround, use the default installation folder, which is automatically secured by th...

CVE-2024-28240

GLPI-Agent (Windows MSI install) is affected by CVE-2024-28240. A local user can cause denial of service by replacing the GLPI server URL or disabling the agent service, and if the Deploy task is installed, can trigger privilege escalation by configuring a malicious server with its own deploy tas...

CVE-2023-34254

The CVE-2023-34254 issue affects GLPI Agent (pre-1.5) where, during a remoteinventory task over SSH on Unix, an remote administrator could inject commands into the agent’s workflow, potentially gaining high privileges on the host and exposing configured remote access. Root cause is input/command ...