GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”. As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors. This is fixed in version 9.5.4.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/161680/GLPI-9.5.3-Unsafe-Reflection.html | Exploit Third Party Advisory VDB Entry |
| https://github.com/glpi-project/glpi/releases/tag/9.5.4 | Release Notes |
| https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp | Vendor Advisory |
Configurations
History
26 Jun 2023, 19:20
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-470 | |
| References | (CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp - Vendor Advisory |
16 Mar 2021, 18:20
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CPE | cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* | |
| References | (MISC) http://packetstormsecurity.com/files/161680/GLPI-9.5.3-Unsafe-Reflection.html - Exploit, Third Party Advisory, VDB Entry | |
| References | (CONFIRM) https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp - Third Party Advisory | |
| References | (MISC) https://github.com/glpi-project/glpi/releases/tag/9.5.4 - Release Notes, Third Party Advisory |
08 Mar 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”. As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors. This is fixed in version 9.5.4. | |
| CWE | CWE-862 | |
| References |
|
08 Mar 2021, 17:38
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-03-08 17:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-21327
Mitre link : CVE-2021-21327
CVE.ORG link : CVE-2021-21327
JSON object : View
Products Affected
glpi-project
- glpi