CVE-2024-41679: Authenticated SQL injection in ticket form
Published Nov 15, 2024
·Updated
GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.
Affected Software
1 affected component
GLPI-PROJECT GLPI>=10.0.0<10.0.17
Event History
Nov 15, 2024
CVE Published
via MITRE·06:20 PM
Data Sourced
via MITRE·06:20 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-41679?
CVE-2024-41679 is considered a high severity SQL injection vulnerability affecting GLPI.
2
How do I fix CVE-2024-41679?
To fix CVE-2024-41679, upgrade to GLPI version 10.0.17 or later.
3
Who is affected by CVE-2024-41679?
Authenticated users of GLPI versions between 10.0.0 and 10.0.16 are affected by CVE-2024-41679.
4
What type of vulnerability is CVE-2024-41679?
CVE-2024-41679 is a SQL injection vulnerability found in the ticket form of GLPI.
5
What can an attacker do with CVE-2024-41679?
An attacker can exploit CVE-2024-41679 to execute arbitrary SQL queries on the database through the ticket form.