CVE-2024-50339 — Cross-site Scripting in Glpi

CWE-79 — Cross-site ScriptingCWE-287 — Improper AuthenticationCWE-384 — Session Fixation3 documents3 sources
Severity
9.3CRITICALNVD
EPSS
21.5%
top 4.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedDec 12
Latest updateJan 28

Description

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDglpi-project/glpi9.5.0 — 10.0.17
▶CVEListV5glpi-project/glpi>= 9.5.0, < 10.0.17

🔴Vulnerability Details

1
OSV
CVE-2024-50339: GLPI is a free asset and IT management software package↗2024-12-12
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS GLPI Leakymetry Authentication Bypass via Session Hijacking (CVE-2024-50339)↗2026-01-28
▶