CVE-2024-47761: GLPI vulnerable to account takeover via the password reset feature
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47761?
CVE-2024-47761 is considered a medium severity vulnerability that could allow unauthorized access to higher privilege accounts.
How do I fix CVE-2024-47761?
To fix CVE-2024-47761, upgrade GLPI to version 10.0.17 or later.
What versions of GLPI are affected by CVE-2024-47761?
CVE-2024-47761 affects GLPI versions from 0.80 through 10.0.16.
Who is impacted by CVE-2024-47761?
Administrators of GLPI who have access to sent notification contents are at risk from CVE-2024-47761.
What should I do if I cannot upgrade from the vulnerable version regarding CVE-2024-47761?
If upgrading is not possible, review your user permissions and limit access to sent notifications to mitigate risks from CVE-2024-47761.