CVE-2023-34106
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
GLPI is a free asset and IT management software package. Versions from 0.68 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to the list of all users and their personal information.
Risk Assessment
The organization may be exposed to the disclosure of users' personal data, which could lead to privacy violations and potential legal consequences.
Recommendation
It is recommended to upgrade to version 10.0.8 to apply the patch that addresses this vulnerability.
Original NVD description (English source)
GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch.