CVE-2025-27147: GLPI Inventory plugin has Improper Access Control Vulnerability
First published: Tue Mar 25 2025(Updated: )
The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GLPI Inventory Plugin | <1.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-27147?
CVE-2025-27147 is classified as a high severity vulnerability due to improper access control in the GLPI Inventory Plugin.
How do I fix CVE-2025-27147?
To fix CVE-2025-27147, upgrade the GLPI Inventory Plugin to version 1.5.0 or later.
What versions are affected by CVE-2025-27147?
CVE-2025-27147 affects all versions of the GLPI Inventory Plugin prior to version 1.5.0.
What type of tasks does the GLPI Inventory Plugin handle that is impacted by CVE-2025-27147?
CVE-2025-27147 impacts tasks such as network discovery, software deployment, and data collection within the GLPI Inventory Plugin.
Is the GLPI Inventory Plugin still secure after the patch for CVE-2025-27147?
Yes, the GLPI Inventory Plugin is secure after upgrading to version 1.5.0, which addresses the access control issues.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/title
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/author
- agent/source
- agent/description
- agent/type
- agent/first-publish-date
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- collector/epss-latest
- source/FIRST
- agent/epss
- vendor/glpi
- canonical/glpi inventory plugin