VulnerabilityModified
CVE-2021-39211
Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information.
MEDIUM 5.3EPSS 4.70%
Does this matter?
Lower severity and a low EPSS score (4.70%). Track it; it rarely justifies an emergency change on its own.
Description
GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.php`, which is not needed for usual functions of GLPI.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 4.70% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- glpi-project/glpi
- Source
- security-advisories@github.com
References
- https://github.com/glpi-project/glpi/releases/tag/9.5.6Release Notes, Third Party Advisory
- https://github.com/glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825Third Party Advisory
- https://github.com/glpi-project/glpi/releases/tag/9.5.6Release Notes, Third Party Advisory
- https://github.com/glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.