PT-2021-22461 · Glpi+1 · Glpi+1

Am0O0 · Published 2021-09-15 · Updated 2024-05-22 · CVE-2021-39209

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.5.6

Description The issue allows a malicious actor to bypass Cross-Site Request Forgery (CSRF) protection in many places, enabling them to perform various actions on GLPI. This can be exploited by a user who is logged in to GLPI.

Recommendations For versions prior to 9.5.6, upgrade to version 9.5.6 to resolve the issue. At the moment, there is no information about other workarounds aside from upgrading.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2021-3030

ALT-PU-2021-3038

ALT-PU-2021-3059

ALT-PU-2024-8094

CVE-2021-39209

GHSA-5QPF-32W7-C56P

Affected Products

Alt Linux

Glpi

References · 8

• https://osv.dev/vulnerability/CVE-2021-39209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39209 · Security Note
• https://ubuntu.com/security/CVE-2021-39209 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39209 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39209 · Vendor Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-5qpf-32w7-c56p · Note
• https://github.com/glpi-project/glpi/releases/tag/9.5.6 · Note
• https://t.me/cibsecurity/28922 · Telegram Post