CVE-2024-40638CWE-89

GLPI allows account takeover via SQL Injection in AJAX scripts

High · published November 15, 2024

CVSS v3.1

8.1

EPSS

38%

Percentile

98.6

In the wild

Unconfirmed

What it is

GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.38299 · 98.6th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2024-11-15T18:06Z

EPSS history

Timeline

15 NOV 18:06Z
GLPI allows account takeover via SQL Injection in AJAX scripts
cvelistv5