PoC Index

CVE-2024-29889

HIGH 8.1EPSS 63.0%

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.

CVSS v3.1
8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v3.1
7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS
62.96% chance of exploitation in the next 30 days, 99th percentile
Nuclei
high · CWE-89
Published
2024-05-07
Updated
2024-08-02

Nuclei templates (1)

References

Related