CVE-2024-28241

2024-04-2517:15:49

CWE-269

GitHub_M

web.nvd.nist.gov

glpi agent

local user

code modification

privilege escalation

upgrade

default installation

system security

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

Percentile

9.0%

JSON

The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which involves installed folder is automatically secured by the system.

Affected configurations

Vulners

Node

glpi-projectglpi_agentRange<1.7.2

VendorProductVersionCPE
glpi-projectglpi_agent*cpe:2.3:a:glpi-project:glpi_agent:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
glpi-project	glpi_agent	*	cpe:2.3:a:glpi-project:glpi_agent::::::::

CNA Affected

[
  {
    "vendor": "glpi-project",
    "product": "glpi-agent",
    "versions": [
      {
        "version": "< 1.7.2",
        "status": "affected"
      }
    ]
  }
]