PT-2022-11910 · Glpi · Glpi

Hansmach1Ne · Published 2022-01-05 · Updated 2022-08-09 · CVE-2021-43779

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 2.9.1

Description GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin suffers from authenticated Remote Code Execution, allowing access to the server's underlying operating system using command injection abuse of functionality.

Recommendations For versions prior to 2.9.1, upgrade to version 2.9.1 or later. As a temporary workaround, consider disabling the addressing plugin until a patch is available.

Exploit

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2021-43779

GHSA-Q5FP-XPR8-77JH

Affected Products

Glpi

References · 10

• 🔥 https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh · Exploit
• 🔥 https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779 · Exploit
• 🔥❌ https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin · Exploit, Deleted
• https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366 · Patch
• https://cve.org/CVERecord?id=CVE-2021-43779 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43779 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-43779 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43779 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43779 · Vendor Advisory
• https://t.me/cibsecurity/35008 · Telegram Post