CVE-2024-29889: GLPI contains an SQL injection through the saved searches
GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29889?
CVE-2024-29889 is categorized as a critical vulnerability due to its potential to allow authenticated users to perform unauthorized actions on user accounts.
How do I fix CVE-2024-29889?
To fix CVE-2024-29889, upgrade GLPI to version 10.0.15 or later.
Who is affected by CVE-2024-29889?
CVE-2024-29889 affects all versions of GLPI prior to 10.0.15.
What impact does CVE-2024-29889 have on GLPI users?
CVE-2024-29889 allows an authenticated user to exploit SQL injection vulnerabilities, potentially allowing them to alter other user account data.
Does CVE-2024-29889 require authentication to exploit?
Yes, CVE-2024-29889 requires an authenticated user to exploit the SQL injection vulnerability in GLPI.