CVE-2024-41678: GLPI has multiple reflected XSS
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41678?
CVE-2024-41678 is categorized as a reflected XSS vulnerability, which can lead to session hijacking or other malicious actions.
How do I fix CVE-2024-41678?
To fix CVE-2024-41678, upgrade your GLPI software to version 10.0.17 or later.
Who is affected by CVE-2024-41678?
CVE-2024-41678 affects all versions of GLPI prior to 10.0.17 that allow unauthenticated users to exploit the system.
What are the potential risks of CVE-2024-41678?
The potential risks of CVE-2024-41678 include unauthorized access, data theft, and manipulation of application behavior through malicious scripts.
Is user authentication required to exploit CVE-2024-41678?
No, CVE-2024-41678 can be exploited by an unauthenticated user through malicious links.