by Kastro
Paper/Archive/CVE-2024-50339

CVE-2024-50339

glpi-project glpi — GLPI vulnerable to unauthenticated session hijacking

EPSS 19%CVSS 9.3
critical.is priorityof 100
47
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 97.3.973 × 2019.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

Affected

ProductAffectedFixed inSource
glpi>= 9.5.0, < 10.0.17–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/glpi-project/glpi/security/advisories/GHSA-v977-g4r9-6r72refgithub.com/glpi-project/glpi/releases/tag/10.0.17