SB20261007225 - Multiple vulnerabilities in GLPI

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to enumerate names of GLPI users.

The vulnerability exists due to missing authentication checks in the planning feature when handling requests. A remote attacker can access the planning feature without authentication to enumerate names of GLPI users.

2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization checks in the planning feature when accessing event content. A remote privileged user can access the content of events outside their authorized entity scope to disclose sensitive information.

The advisory identifies GLPI technician accounts as able to exploit this issue.

Remediation

Install update from vendor's website.

References

• https://github.com/glpi-project/glpi/security/advisories/GHSA-j5vx-jrmw-2498
• https://github.com/glpi-project/glpi/security/advisories/GHSA-5fw5-vgrw-ggp5