CVE-2024-43416: GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43416?
CVE-2024-43416 is considered a medium severity vulnerability due to its potential for unauthorized information exposure.
How do I fix CVE-2024-43416?
To fix CVE-2024-43416, upgrade to GLPI version 10.0.17 or later, as it addresses the vulnerability.
Who is affected by CVE-2024-43416?
CVE-2024-43416 affects all users of GLPI versions from 0.80 up to, but not including, 10.0.17.
What type of vulnerability is CVE-2024-43416?
CVE-2024-43416 is an information disclosure vulnerability that allows unauthenticated users to verify valid email addresses.
What is the impact of CVE-2024-43416?
The impact of CVE-2024-43416 allows attackers to enumerate valid user email addresses, potentially leading to targeted phishing attacks.