VulnerabilityAnalyzed

CVE-2024-50339

GLPI is a free asset and IT management software package.

CRITICAL 9.3EPSS 19.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 19.6%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 19.62% probability · 97th percentile
CISA KEV: Not listed
Weakness: CWE-79, CWE-287, CWE-384
Affected: glpi-project/glpi
Source: security-advisories@github.com

References

https://github.com/glpi-project/glpi/releases/tag/10.0.17Release Notes
https://github.com/glpi-project/glpi/security/advisories/GHSA-v977-g4r9-6r72Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.