CVE-2021-39211CWE-200

Disclosure of GLPI and server information in telemetry endpoint

Medium · published September 15, 2021

CVSS v3.1
5.3
EPSS
5%
Percentile
91.5
In the wild
Unconfirmed
What it is

GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.php`, which is not needed for usual functions of GLPI.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.04516 · 91.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-09-15T16:55Z
EPSS history
Timeline
  • 15 SEP 16:55Z
    Disclosure of GLPI and server information in telemetry endpoint
    cvelistv5