Ubuntu.comUB:CVE-2021-21255CVE-2021-21255
5.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
25.9%
GLPI is an open-source asset and IT management software package that
provides ITIL Service Desk features, licenses tracking and software
auditing. In GLPI version 9.5.3, it was possible to switch entities with
IDOR from a logged in user. This is fixed in version 9.5.4.
References
github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dc
github.com/glpi-project/glpi/security/advisories/GHSA-v3m5-r3mx-ff9j
launchpad.net/bugs/cve/CVE-2021-21255
nvd.nist.gov/vuln/detail/CVE-2021-21255
security-tracker.debian.org/tracker/CVE-2021-21255
www.cve.org/CVERecord?id=CVE-2021-21255
Related
5.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
25.9%