CVE-2024-31456CWE-89

GLPI contains an authenticated SQL injection

High · published May 7, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.7. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1

7.7

EPSS

59%

Percentile

99.1

In the wild

Unconfirmed

What it is

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.

The record

Technical detail

CVSS v3.1: 7.7 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.59136 · 99.1th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2024-05-07T14:07Z

EPSS history

Timeline

07 MAY 14:07Z
GLPI contains an authenticated SQL injection
cvelistv5