CVE-2024-27937
published 2024-03-18CVE-2024-27937: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated…
PriorityP433medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
26.81%
97.8th percentile
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| glpi-project | glpi | — | — |
| glpi-project | glpi | >= 10.0.0 < 10.0.13 | 10.0.13 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS GLPI Authenticated Object Disclosure via Dropdown Component (CVE-2024-27937, CVE-2024-27930)
suricata·2026-01-28·CVSS 6.5
CVE-2024-27937 [MEDIUM] ET WEB_SPECIFIC_APPS GLPI Authenticated Object Disclosure via Dropdown Component (CVE-2024-27937, CVE-2024-27930)
ET WEB_SPECIFIC_APPS GLPI Authenticated Object Disclosure via Dropdown Component (CVE-2024-27937, CVE-2024-27930)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS GLPI Authenticated Object Disclosure via Dropdown Component (CVE-2024-27937, CVE-2024-27930)"; flow:established,to_server; http.uri; content:"/ajax/getDropdownValue.php"; fast_pattern; http.request_body; content:"_idor_token|3d|"; content:"itemtype|3d|"; content:"displaywith|5b 5d 3d|"; content:"entity_restrict|3d|-1"; http.method; content:"POST"; reference:url,github.com/Orange-Cyberdefense/glpwnme/; reference:cve,2024-27937; reference:cve,2024-27930; classtype:web-application-attack; sid:2067164; rev:1; metadata:affected_product GLPI, attack_target Server, tls_state TLSDecrypt, created_at 2026_01_28, cve CV
No public exploits indexed.
No writeups or analysis indexed.
https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.htmlhttps://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892dahttps://github.com/glpi-project/glpi/releases/tag/10.0.13https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpjhttps://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.htmlhttps://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892dahttps://github.com/glpi-project/glpi/releases/tag/10.0.13https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj
2024-03-18
Published