CVE-2024-37148: GLPI allows account takeover via SQL Injection in AJAX scripts
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37148?
CVE-2024-37148 has a high severity due to its potential to allow unauthorized access to user accounts.
How do I fix CVE-2024-37148?
To fix CVE-2024-37148, update GLPI to version 10.0.17 or later to mitigate the SQL injection vulnerability.
Who is affected by CVE-2024-37148?
CVE-2024-37148 affects all versions of GLPI from 0.84 up to 10.0.16.
What types of vulnerabilities are associated with CVE-2024-37148?
CVE-2024-37148 is associated with SQL injection vulnerabilities in AJAX scripts.
Can CVE-2024-37148 be exploited remotely?
CVE-2024-37148 requires authentication, meaning that an authenticated user can exploit the vulnerability.