CVE-2024-29889CWE-89

GLPI contains an SQL injection through the saved searches

High · published May 7, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.1. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1

7.1

EPSS

65%

Percentile

99.2

In the wild

Unconfirmed

What it is

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.

The record

Technical detail

CVSS v3.1: 7.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.64691 · 99.2th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2024-05-07T14:05Z

EPSS history

Timeline

07 MAY 14:05Z
GLPI contains an SQL injection through the saved searches
cvelistv5