CVE-2024-27096CWE-89

SQL Injection in through the search engine

High · published March 18, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.7. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1

7.7

EPSS

59%

Percentile

99.1

In the wild

Unconfirmed

What it is

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13.

The record

Technical detail

CVSS v3.1: 7.7 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.58818 · 99.1th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2024-03-18T16:11Z

EPSS history

Timeline

18 MAR 16:11Z
SQL Injection in through the search engine
cvelistv5