PT-2019-13202 · Teclib+1 · Glpi+1

Published 2019-04-09 · Updated 2019-07-17 · CVE-2019-13240

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.4.1

Description An issue in GLPI allows a user's password to be changed again within 24 hours of a successful password reset, using only the associated email address.

Recommendations For versions prior to 9.4.1, update to version 9.4.1 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

ALT-PU-2019-1613

CVE-2019-13240

Affected Products

Alt Linux

Glpi

References · 7

• 🔥 https://synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf · Exploit
• https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6 · Patch
• https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7 · Patch
• https://github.com/glpi-project/glpi/compare/1783b78...8e621f6 · Patch
• https://osv.dev/vulnerability/CVE-2019-13240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13240 · Security Note
• https://github.com/glpi-project/glpi/releases/tag/9.4.1 · Note