PT-2024-8175 · Glpi+2 · Glpi+2

Qbiguenet · Published 2024-11-06 · Updated 2025-08-13 · CVE-2024-47758

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.3.0 through 10.0.16

Description: The issue is related to incorrect access control in the GLPI system, which can be exploited by a remote attacker to gain unauthorized access to an account through the API. An authenticated user can use the API to take control of any user with the same or lower level of privileges.

Recommendations: For GLPI versions 9.3.0 through 10.0.16, update to version 10.0.17 or later to resolve the issue. As a temporary workaround, consider restricting API access to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2025-10163

ALT-PU-2025-1277

BDU:2024-09717

CVE-2024-47758

GHSA-3R4X-6PMX-PHWR

Affected Products

Alt Linux

Glpi

Red Os

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47758.json · Exploit
• 🔥 https://github.com/MatheuZSecurity/Exploit-CVE-2025-24799 · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-3r4x-6pmx-phwr · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47758 · Security Note
• https://bdu.fstec.ru/vul/2024-09717 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47758 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47758 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/713634 · Security Note
• https://ubuntu.com/security/CVE-2024-47758 · Vendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.17 · Note
• https://t.me/cvedetector/12637 · Telegram Post
• https://cybersecurity-help.cz/vulnerabilities/99872 · Note
• https://twitter.com/CVEnew/status/1868271121994223927 · Twitter Post