CVE-2021-39211

Disclosure of GLPI and server information in telemetry endpoint

GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.php`, which is not needed for usual functions of GLPI.

Affected

glpi-project · glpi

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

4.52% chance of exploitation in the next 30 days, 91st percentile

Nuclei

medium

Published

2021-09-15

Updated

2024-08-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39211.yaml

Security advisories

• glpi-project/glpi/releases/tag/9.5.6
• glpi-project/glpi/security/advisories/GHSA-xx66-v3g5-w825

References

• CVE Record
• NVD entry