CVE-2024-43417: Reflected XSS in Software form
Published Nov 15, 2024
·Updated
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17.
Affected Software
1 affected component
GLPI-PROJECT GLPI>=10.0.0<10.0.17
Event History
Nov 15, 2024
CVE Published
via MITRE·06:22 PM
Data Sourced
via MITRE·06:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-43417?
CVE-2024-43417 is classified as a medium severity reflected XSS vulnerability in GLPI.
2
How do I fix CVE-2024-43417?
To fix CVE-2024-43417, upgrade GLPI to version 10.0.17 or later.
3
Who is affected by CVE-2024-43417?
CVE-2024-43417 affects all versions of GLPI prior to 10.0.17.
4
What type of vulnerability is CVE-2024-43417?
CVE-2024-43417 is a reflected cross-site scripting (XSS) vulnerability.
5
What can an attacker do with CVE-2024-43417?
An attacker can exploit CVE-2024-43417 by tricking a GLPI technician into clicking a malicious link, potentially allowing unauthorized actions.