CVE-2021-43779: Remote Command Execution vulnerability
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-43779?
CVE-2021-43779 is a vulnerability in the GLPI addressing plugin in versions < 2.9.1, which allows authenticated remote code execution through command injection.
What is GLPI?
GLPI is an open source IT Asset Management, issue tracking system, and service desk system.
How severe is CVE-2021-43779?
CVE-2021-43779 has a severity rating of critical with a CVSS score of 9.9.
How can I check if my GLPI version is affected by CVE-2021-43779?
If your GLPI version is less than 2.9.1 and has the addressing plugin installed, it may be affected by CVE-2021-43779.
How can I fix CVE-2021-43779?
To fix CVE-2021-43779, update your GLPI instance to version 2.9.1 or higher, and ensure that the addressing plugin is up to date.