CVE-2024-40638

high · 8.1

GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.

8.1

CVSS

37.4%

EPSS (exploit prob.)

98th

EPSS percentile

2024-11-15

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
glpi-project	glpi	>= 0.85, < 10.0.17

Check a specific version with /api/v1/cve/match.

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-8843-r3m7-gfqx

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-40638