What is CVE-2023-28632?

CVE-2023-28632 is a vulnerability in GLPI software that allows an authenticated user to modify emails and take over another user's account through the "forgotten password" feature.

What is the severity of CVE-2023-28632?

CVE-2023-28632 has a severity level of 8.1 (high).

Which versions of GLPI are affected by CVE-2023-28632?

Versions 0.83 to 9.5.13 and 10.0.0 to 10.0.7 of GLPI are affected by CVE-2023-28632.

How can an authenticated user exploit CVE-2023-28632?

An authenticated user can exploit CVE-2023-28632 by modifying emails of any user and utilizing the "forgotten password" feature to take over another user account.

How can I mitigate the vulnerability CVE-2023-28632?

To mitigate CVE-2023-28632, update GLPI to version 9.5.13 or 10.0.7, as these versions contain the necessary security fixes.

Vulnerability/
CVE-2023-28632

high

8.1

CWE

269

5/4/2023

12/4/2023

CVE-2023-28632

First published: Wed Apr 05 2023(Updated: )

GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `Forgotten password?` event. However, it will not prevent unauthorized modification of any user emails.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
GLPI-PROJECT GLPI	>=0.83<9.5.13
GLPI-PROJECT GLPI	>=10.0.0<10.0.7

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-28632?
CVE-2023-28632 is a vulnerability in GLPI software that allows an authenticated user to modify emails and take over another user's account through the "forgotten password" feature.
What is the severity of CVE-2023-28632?
CVE-2023-28632 has a severity level of 8.1 (high).
Which versions of GLPI are affected by CVE-2023-28632?
Versions 0.83 to 9.5.13 and 10.0.0 to 10.0.7 of GLPI are affected by CVE-2023-28632.
How can an authenticated user exploit CVE-2023-28632?
An authenticated user can exploit CVE-2023-28632 by modifying emails of any user and utilizing the "forgotten password" feature to take over another user account.
How can I mitigate the vulnerability CVE-2023-28632?
To mitigate CVE-2023-28632, update GLPI to version 9.5.13 or 10.0.7, as these versions contain the necessary security fixes.

collector/nvd-index
agent/weakness
agent/severity
agent/references
agent/author
agent/description
agent/tags
agent/type
agent/event
agent/first-publish-date
agent/softwarecombine
agent/last-modified-date
agent/remedy
vendor/glpi-project
canonical/glpi-project glpi
version/glpi-project glpi/0.83
version/glpi-project glpi/10.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.