CVE-2021-43779criticalCWE-20

CVE-2021-43779: critical vulnerability in pluginsGLPI addressing

Remote Command Execution vulnerability

Published · Updated

Follow this CVE+ Monitor addressing

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 9.1%
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
Affected products
pluginsGLPI · addressing
Related CVEs — pluginsGLPI addressing

In the same product, most dangerous first.

CVE-2024-53850HIGHThe Addressing GLPI plugin allows data enumeration through uncontrolled object instantiationEPSS 0.5%