CVE-2024-37147: GLPI allows Authenticated File Upload to Restricted Tickets
Published Jul 10, 2024
·Updated
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16.
Affected Software
1 affected component
GLPI-PROJECT GLPI>=0.85<10.0.16
Event History
Jul 10, 2024
CVE Published
via MITRE·06:38 PM
Data Sourced
via MITRE·06:38 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-37147?
The severity of CVE-2024-37147 is considered to be moderate as an authenticated user can manipulate documents even without write access.
2
How do I fix CVE-2024-37147?
To fix CVE-2024-37147, upgrade GLPI to version 10.0.16 or later.
3
Who is affected by CVE-2024-37147?
Authenticated users of GLPI who can attach documents may be affected by CVE-2024-37147.
4
What versions of GLPI are vulnerable to CVE-2024-37147?
GLPI versions prior to 10.0.16 are vulnerable to CVE-2024-37147.
5
What type of vulnerability is CVE-2024-37147?
CVE-2024-37147 is a permission-related vulnerability that allows unauthorized document attachment by authenticated users.