PT-2025-6973 · Unknown+3 · Oauthimap Plugin+3

Moderatetrasher · Published 2025-02-12 · Updated 2025-08-13 · CVE-2025-23046

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 9.5.0 through 10.0.17

Description The issue allows unauthorized access to GLPI when a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, leveraging existing Oauth authorizations.

Recommendations For versions 9.5.0 through 10.0.17, update to version 10.0.18 to resolve the issue. As a temporary workaround, consider disabling any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-303

Related Identifiers

ALT-PU-2025-10163

ALT-PU-2025-4115

BDU:2025-04582

CVE-2025-23046

GHSA-VFXC-QG3V-J2R5

Affected Products

Alt Linux

Glpi

Oauthimap Plugin

Red Os

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23046.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-23046 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04582 · Security Note
• https://ubuntu.com/security/CVE-2025-23046 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-23046 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23046 · Security Note
• https://github.com/glpi-project/glpi/releases/tag/10.0.18 · Note
• https://github.com/glpi-project/glpi/security/advisories/GHSA-vfxc-qg3v-j2r5 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-020425 · Note
• https://t.me/cvedetector/18905 · Telegram Post
• https://twitter.com/CVEnew/status/1894452246533796242 · Twitter Post
• https://twitter.com/GLPI_PROJECT/status/1889662882909950415 · Twitter Post