GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `Forgotten password?` event. However, it will not prevent unauthorized modification of any user emails.
References
| Link | Resource |
|---|---|
| https://github.com/glpi-project/glpi/releases/tag/10.0.7 | Patch Release Notes |
| https://github.com/glpi-project/glpi/releases/tag/9.5.13 | Patch Release Notes |
| https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x | Vendor Advisory |
| https://github.com/glpi-project/glpi/releases/tag/10.0.7 | Patch Release Notes |
| https://github.com/glpi-project/glpi/releases/tag/9.5.13 | Patch Release Notes |
| https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/glpi-project/glpi/releases/tag/10.0.7 - Patch, Release Notes | |
| References | () https://github.com/glpi-project/glpi/releases/tag/9.5.13 - Patch, Release Notes | |
| References | () https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x - Vendor Advisory |
12 Apr 2023, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/glpi-project/glpi/releases/tag/10.0.7 - Patch, Release Notes | |
| References | (MISC) https://github.com/glpi-project/glpi/releases/tag/9.5.13 - Patch, Release Notes | |
| References | (MISC) https://github.com/glpi-project/glpi/security/advisories/GHSA-7pwm-pg76-3q9x - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| First Time |
Glpi-project
Glpi-project glpi |
|
| CPE | cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* |
05 Apr 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-05 15:15
Updated : 2024-11-21 07:55
NVD link : CVE-2023-28632
Mitre link : CVE-2023-28632
CVE.ORG link : CVE-2023-28632
JSON object : View
Products Affected
glpi-project
- glpi
CWE
CWE-269
Improper Privilege Management