CVE-2015-7685
published 2015-10-05CVE-2015-7685: GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter…
PriorityP418medium4CVSS 2.0
AVNACLAuSCNIPAN
EPSS
1.67%
74.0th percentile
GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter to front/user.form.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| glpi-project | glpi | <= 0.85.2 | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j94f-6q7g-jjgv: GLPI before 0
ghsa_unreviewed·2022-05-17
CVE-2015-7685 [MEDIUM] GHSA-j94f-6q7g-jjgv: GLPI before 0
GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter to front/user.form.php.
OSV
CVE-2015-7685: GLPI before 0
osv·2015-10-05·CVSS 4.0
CVE-2015-7685 [MEDIUM] CVE-2015-7685: GLPI before 0
GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter to front/user.form.php.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2015/Feb/71http://www.glpi-project.org/spip.php?page=annonce&id_breve=338https://forge.glpi-project.org/issues/5218http://seclists.org/fulldisclosure/2015/Feb/71http://www.glpi-project.org/spip.php?page=annonce&id_breve=338https://forge.glpi-project.org/issues/5218
2015-10-05
Published