CVE-2023-41323mediumCWE-200

CVE-2023-41323: medium-severity vulnerability in glpi-project glpi

Users login enumeration by unauthenticated user in GLPI

Published · Updated

Follow this CVE+ Monitor glpi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 34%
In short

An attacker without a user account can discover valid usernames in GLPI by exploiting how the system handles login attempts, potentially using this information for further attacks like password guessing.

Technical detail

Unauthenticated user enumeration vulnerability in GLPI allows attackers to determine valid usernames through login response analysis or similar timing/response-based techniques. This information disclosure (CWE-200) enables account enumeration without authentication, facilitating subsequent credential attacks and reducing attack complexity.

Summary generated and translated by AI from the official description.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can enumerate users logins. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
glpi-project · glpi
Related CVEs — glpi-project glpi

In the same product, most dangerous first.

CVE-2025-24799HIGHGLPI allows unauthenticated SQL injection through the inventory endpointEPSS 86.8%CVE-2020-15175HIGHUnauthenticated File Deletion in GLPIEPSS 69.9%CVE-2023-46727HIGHGLPI SQL injection through inventory agent requestEPSS 67.7%CVE-2024-29889HIGHGLPI contains an SQL injection through the saved searchesEPSS 64.7%CVE-2024-31456HIGHGLPI contains an authenticated SQL injectionEPSS 59.1%CVE-2024-27096HIGHSQL Injection in through the search engineEPSS 58.8%