CVE-2024-50339CWE-287CWE-79

GLPI vulnerable to unauthenticated session hijacking

Critical · published December 11, 2024

CVSS v4.0

9.3

EPSS

19%

Percentile

97.3

In the wild

Unconfirmed

What it is

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

The record

Technical detail

CVSS v4.0: 9.3 · CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS: 0.18722 · 97.3th percentile
Weaknesses: CWE-287 · Improper Authentication; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2024-12-11T17:48Z

EPSS history

Timeline

11 DEC 17:48Z
GLPI vulnerable to unauthenticated session hijacking
cvelistv5