PT-2024-9988 · Glpi · Addressing Glpi Plugin

Flegastelois · Published 2024-11-22 · Updated 2024-12-26 · CVE-2024-53850

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Addressing GLPI plugin versions 3.0.0 through 3.0.3

Description: The issue is related to a poor security check in the Addressing GLPI plugin, which allows an unauthenticated attacker to determine whether data exists by name in GLPI. This can potentially lead to unauthorized access to protected information. The vulnerability is associated with the use of external controlled input for selecting classes or code.

Recommendations: For versions 3.0.0 through 3.0.3, update to version 3.0.3 or later to resolve the issue. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-470

Related Identifiers

BDU:2025-00106

CVE-2024-53850

GHSA-FW42-79GW-7QR9

Affected Products

Addressing Glpi Plugin

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53850.json · Exploit
• https://bdu.fstec.ru/vul/2025-00106 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-53850 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53850 · Vendor Advisory
• https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-fw42-79gw-7qr9 · Note
• https://github.com/pluginsGLPI/addressing/commit/b334187a99206abbd7d0bc84f720b0a6e69e92f0 · Note
• https://twitter.com/VulmonFeeds/status/1872413434463031660 · Twitter Post
• https://t.me/cvedetector/13699 · Telegram Post
• https://vuldb.com/?id.289363 · Note
• https://twitter.com/CVEnew/status/1872399594736243185 · Twitter Post