PT-2024-5859 · Glpi+2 · Glpi+2

Guilhem7 · Published 2024-07-10 · Updated 2025-01-07 · CVE-2024-37149

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.16

Description The issue is related to the GLPI system, which is an open-source asset and IT management software package providing ITIL Service Desk features, licenses tracking, and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. This is due to external control of the file name or path.

Recommendations For versions prior to 10.0.16, upgrade to 10.0.16 to resolve the issue. As a temporary workaround, consider restricting access to the plugin loader to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-73

CWE-94

Related Identifiers

ALT-PU-2024-10022

ALT-PU-2024-9613

BDU:2024-06606

CVE-2024-37149

GHSA-CWVP-J887-M4XH

Affected Products

Alt Linux

Glpi

Red Os

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37149.json · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-cwvp-j887-m4xh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37149 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37149 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-37149 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-37149 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/709445 · Security Note
• https://bdu.fstec.ru/vul/2024-06606 · Security Note
• https://ubuntu.com/security/CVE-2024-37149 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2024-37147-cve-2024-37148-cve-2024-37149 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://twitter.com/VulmonFeeds/status/1811171147431452855 · Twitter Post
• https://t.me/cvenotify/85726 · Telegram Post
• https://twitter.com/Hawatel_company/status/1811339690391347569 · Twitter Post
• https://t.me/cvedetector/587 · Telegram Post