CVE-2023-34107
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
GLPI is a free asset and IT management software package. Versions from 9.2.0 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to view all KnowbaseItems.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive information in the knowledge base, potentially leading to data leaks.
Recommendation
It is recommended to upgrade to version 10.0.8 or later to patch this vulnerability.
Original NVD description (English source)
GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue.