CVE-2024-41679

Authenticated SQL injection in ticket form

CVSS 6.5 MEDIUMEPSS 0.5%CWE-89

GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

glpi-project · glpi

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/glpi-project/glpi/security/advisories/GHSA-hq9q-jfhp-qqgm