Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2021-39211 — Sensitive Information Exposure in Glpi

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
38.9%
top 2.72%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Glpi-project Glpi
Timeline
PublishedSep 15

Description

GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.php`, which is not needed for usual functions of GLPI.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDglpi-project/glpi9.2 — 9.5.6
▶CVEListV5glpi-project/glpi>= 9.2, < 9.5.6

🔴Vulnerability Details

2
OSV
CVE-2021-39211: GLPI is a free Asset and IT management software package↗2021-09-15
▶
VulnCheck
GLPI Telemetry Endpoint Information Disclosure↗2021
▶

💥Exploits & PoCs

1
Nuclei
GLPI 9.2/<9.5.6 - Information Disclosure
▶