CVE-2023-35924
HighCVSS 8.6Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
GLPI is a free asset and IT management software package. In versions 10.0.0 to 10.0.7, the GLPI inventory endpoint can be exploited for a SQL injection attack as it does not require authentication by default.
Risk Assessment
The lack of authentication on the inventory endpoint may lead to unauthorized access to the database, posing a serious threat to the organization's data security.
Recommendation
It is recommended to upgrade to version 10.0.8, which includes a patch for this vulnerability. Alternatively, disabling native inventory can be a temporary workaround.
Original NVD description (English source)
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.