PT-2025-6972 · Glpi+2 · Glpi+2

Jcervantes-Sipecom · Published 2025-02-12 · Updated 2025-08-13 · CVE-2025-23024

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GLPI versions 0.72 through 10.0.17

Description The issue allows an anonymous user to disable all active plugins. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the install/update.php file.

Recommendations For versions 0.72 through 10.0.17, update to version 10.0.18 to resolve the issue. As a temporary workaround, consider deleting the install/update.php file until the patch is applied.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

ALT-PU-2025-10163

ALT-PU-2025-4115

BDU:2025-04042

CVE-2025-23024

GHSA-885X-HVP2-85Q8

Affected Products

Alt Linux

Glpi

Red Os

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23024.json · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-885x-hvp2-85q8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04042 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23024 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23024 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-23024 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23024 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-23024 · Vendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.18 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-020425 · Note
• https://twitter.com/GLPI_PROJECT/status/1889662881341301006 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-020425/?sphrase_id=834890 · Note
• https://t.me/avleonovcom/1530 · Telegram Post
• https://twitter.com/CVEnew/status/1894421635786022966 · Twitter Post
• https://twitter.com/GLPI_PROJECT/status/1889661041421775092 · Twitter Post