CVE-2024-27930
published 2024-03-18CVE-2024-27930: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.14%
62.6th percentile
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| glpi-project | glpi | — | — |
| glpi-project | glpi | >= 0.78 < 10.0.13 | 10.0.13 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS GLPI Authenticated Object Disclosure via Dropdown Component (CVE-2024-27937, CVE-2024-27930)
suricata·2026-01-28·CVSS 6.5
CVE-2024-27937 [MEDIUM] ET WEB_SPECIFIC_APPS GLPI Authenticated Object Disclosure via Dropdown Component (CVE-2024-27937, CVE-2024-27930)
ET WEB_SPECIFIC_APPS GLPI Authenticated Object Disclosure via Dropdown Component (CVE-2024-27937, CVE-2024-27930)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS GLPI Authenticated Object Disclosure via Dropdown Component (CVE-2024-27937, CVE-2024-27930)"; flow:established,to_server; http.uri; content:"/ajax/getDropdownValue.php"; fast_pattern; http.request_body; content:"_idor_token|3d|"; content:"itemtype|3d|"; content:"displaywith|5b 5d 3d|"; content:"entity_restrict|3d|-1"; http.method; content:"POST"; reference:url,github.com/Orange-Cyberdefense/glpwnme/; reference:cve,2024-27937; reference:cve,2024-27930; classtype:web-application-attack; sid:2067164; rev:1; metadata:affected_product GLPI, attack_target Server, tls_state TLSDecrypt, created_at 2026_01_28, cve CV
No public exploits indexed.
No writeups or analysis indexed.
https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.htmlhttps://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871ehttps://github.com/glpi-project/glpi/releases/tag/10.0.13https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwqhttps://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.htmlhttps://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871ehttps://github.com/glpi-project/glpi/releases/tag/10.0.13https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq
2024-03-18
Published