CVE-2023-41322CWE-269CWE-284

Privilege Escalation from technician to super-admin in GLPI

Medium · published September 26, 2023

CVSS v3.1
4.9
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change the latter's password and then take control of their account. Users are advised to upgrade to version 10.0.10. There are no known work around for this vulnerability.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00920 · 59.9th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-284 · Improper Access Control
Published
2023-09-26T22:34Z
EPSS history
Timeline
  • 26 SEP 22:34Z
    Privilege Escalation from technician to super-admin in GLPI
    cvelistv5