PT-2023-3260 · Glpi+2 · Glpi+2
K1000O23
·
Publicado
2023-04-05
·
Atualizado
2024-05-22
·
CVE-2023-28632
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
GLPI versions 0.83 through 9.5.12
GLPI versions 10.0.0 through 10.0.6
Description
The issue is related to incorrect privilege management in GLPI, allowing an authenticated user to modify emails of any other user, including the administrator's email. This can lead to account takeover through the "forgotten password" feature and potentially allow an attacker to receive sensitive data through GLPI notifications.
Recommendations
For GLPI versions 0.83 through 9.5.12, update to version 9.5.13 to resolve the issue.
For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 to resolve the issue.
As a temporary workaround, consider deactivating all notifications related to the
Forgotten password? event to prevent account takeover, although this will not prevent unauthorized modification of user emails.Exploit
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Glpi
Red Os