CVE-2024-43416: GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
First published: Mon Nov 18 2024(Updated: )
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GLPI | >=0.80<10.0.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-43416?
CVE-2024-43416 is considered a medium severity vulnerability due to its potential for unauthorized information exposure.
How do I fix CVE-2024-43416?
To fix CVE-2024-43416, upgrade to GLPI version 10.0.17 or later, as it addresses the vulnerability.
Who is affected by CVE-2024-43416?
CVE-2024-43416 affects all users of GLPI versions from 0.80 up to, but not including, 10.0.17.
What type of vulnerability is CVE-2024-43416?
CVE-2024-43416 is an information disclosure vulnerability that allows unauthenticated users to verify valid email addresses.
What is the impact of CVE-2024-43416?
The impact of CVE-2024-43416 allows attackers to enumerate valid user email addresses, potentially leading to targeted phishing attacks.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/glpi-project
- canonical/glpi
- version/glpi/0.80