CVE-2023-41326: Account takeover via Kanban feature in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with stealing its account. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-41326?
CVE-2023-41326 is a vulnerability in GLPI, a Free Asset and IT Management Software package, which allows a logged user to hijack the Kanban feature and alter any user field.
What is GLPI?
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package.
How does the CVE-2023-41326 vulnerability affect GLPI?
The CVE-2023-41326 vulnerability allows any logged user to hijack the Kanban feature in GLPI, enabling them to alter any user field.
What is the severity rating of CVE-2023-41326?
The severity rating of CVE-2023-41326 is high, with a severity value of 8.1.
How can I mitigate the CVE-2023-41326 vulnerability in GLPI?
To mitigate the CVE-2023-41326 vulnerability in GLPI, it is recommended to update GLPI to a version higher than 10.0.10.