Lucene search

GoogleOSV:CVE-2024-27098

HistoryMar 18, 2024 - 5:15 p.m.

CVE-2024-27098

2024-03-1817:15:06

Google

osv.dev

glpi

ssrf

vulnerability

patched

version 10.0.13

software

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.4%

JSON

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.

CPENameOperatorVersion
glpieq10.0.3
glpieq9.5.1
glpieq10.0.0
glpieq9.5.3
glpieq9.4.6
glpieq9.5.6
glpieq10.0.0-rc3
glpieq9.4.0-rc1
glpieq10.0.11
glpieq9.5.0-rc2

Name	Operator	Version
glpi	eq	10.0.3
glpi	eq	9.5.1
glpi	eq	10.0.0
glpi	eq	9.5.3
glpi	eq	9.4.6
glpi	eq	9.5.6
glpi	eq	10.0.0-rc3
glpi	eq	9.4.0-rc1
glpi	eq	10.0.11
glpi	eq	9.5.0-rc2

Rows per page:

1-10 of 481

References

github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484

github.com/glpi-project/glpi/releases/tag/10.0.13

github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.4%

JSON

Related for OSV:CVE-2024-27098