CVE-2023-34106: GLPI vulnerable to unauthorized access to User data
First published: Wed Jul 05 2023(Updated: )
GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GLPI-PROJECT GLPI | >=0.68<10.0.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this GLPI vulnerability?
The vulnerability ID for this GLPI vulnerability is CVE-2023-34106.
What is GLPI?
GLPI is a free asset and IT management software package.
What is the severity of CVE-2023-34106?
The severity of CVE-2023-34106 is medium with a CVSS score of 6.5.
How does CVE-2023-34106 affect GLPI?
CVE-2023-34106 allows an authenticated user to access the list of all users and their personal information in versions of GLPI prior to 10.0.8.
How can I fix CVE-2023-34106?
To fix CVE-2023-34106, users should upgrade their GLPI software to version 10.0.8 or later.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/description
- agent/tags
- agent/first-publish-date
- agent/author
- agent/event
- vendor/glpi-project
- canonical/glpi-project glpi
- version/glpi-project glpi/0.68