GLPI Multiple Vulnerabilities
Multiple vulnerabilities in GLPI allow remote attackers to perform SQL injection, cross-site scripting, and security policy bypass, resulting in data integrity loss.
Triage facts
Revision 1- Applicability
- GLPI (< 10.0.27), GLPI (11.0.x < 11.0.9)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 8 public sources
- Freshness
- Revision 1Oct 27, 17:39 UTC
- Source quality
- A1Likely
The French National Cybersecurity Agency (ANSSI) has released an advisory regarding multiple vulnerabilities in the GLPI software. The identified flaws permit attackers to conduct SQL injection (SQLi) attacks, execute remote cross-site scripting (XSS), bypass security policies, and manipulate data integrity. These vulnerabilities affect GLPI versions 10.0.x prior to 10.0.27 and 11.0.x prior to 11.0.9.
Impact
Successful exploitation allows for unauthorized data manipulation, security policy circumvention, and the execution of malicious scripts in the context of user sessions.
Recommendation
- Inventory all internal deployments of GLPI to identify affected versions.
- Apply the latest security patches provided by the GLPI project by upgrading to versions 10.0.27 or 11.0.9 or later.
- Refer to the security advisories published on the GLPI GitHub security page (GHSA-3rr2-mxv6-rmc2, GHSA-5jg3-2qx2-gq7g, GHSA-753w-2942-4pxm, GHSA-75jp-p2vm-9vmh, GHSA-7x93-gxc8-jp8m, GHSA-hv93-qr6v-7mpj, GHSA-pr87-h373-xr6c) for specific mitigation details per CVE.
Immediate actions
Patch GLPI to version 10.0.27 or 11.0.9.
Threat Hunt
Inspect web server logs for SQL injection patterns targeting GLPI endpoints.
Data: Web server access logs
Mitigations
Upgrade GLPI to latest release version.
Vulnerabilities within GLPI