CVE-2024-27937CWE-285

glpi Users emails enumeration

Medium · published March 18, 2024

CVSS v3.1

6.5

EPSS

27%

Percentile

98.1

In the wild

Unconfirmed

What it is

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.27137 · 98.1th percentile
Weakness: CWE-285 · Improper Authorization
Published: 2024-03-18T15:17Z

EPSS history

Timeline

18 MAR 15:17Z
glpi Users emails enumeration
cvelistv5