CVE-2025-53113CWE-284CWE-862

GLPI technicians can access unauthorized information through external links

Low · published July 30, 2025

CVSS v3.1
2.7
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-862 · Missing Authorization
Published
2025-07-30T14:16Z
EPSS history
Timeline
  • 30 JUL 14:16Z
    GLPI technicians can access unauthorized information through external links
    cvelistv5