PT-2021-22463 · Glpi+1 · Glpi+1

Am0O0 · Published 2021-09-15 · Updated 2024-05-22 · CVE-2021-39210

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.5.6

Description The issue affects the autologin cookie used when the "remember me" feature is enabled, making it accessible to scripts. A malicious plugin could exploit this to steal the cookie and use it for autologin.

Recommendations For versions prior to 9.5.6, update to version 9.5.6 to resolve the issue. As a temporary workaround, consider avoiding the use of the "remember me" feature until the update is applied.

Fix

Incorrect Permission

Weakness Enumeration

CWE-1004

CWE-732

Related Identifiers

ALT-PU-2021-3030

ALT-PU-2021-3038

ALT-PU-2021-3059

ALT-PU-2024-8094

CVE-2021-39210

GHSA-HWXQ-4C5F-M4V2

Affected Products

Alt Linux

Glpi

References · 9

• https://ubuntu.com/security/CVE-2021-39210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39210 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-39210 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39210 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39210 · Vendor Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-hwxq-4c5f-m4v2 · Note
• https://github.com/glpi-project/glpi/releases/tag/9.5.6 · Note
• https://t.me/cibsecurity/28927 · Telegram Post
• https://huntr.dev/bounties/b2e99a41-b904-419f-a274-ae383e4925f2 · Note