CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28241 – GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder
https://notcve.org/view.php?id=CVE-2024-28241
25 Apr 2024 — The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which involves installed folder is automatically secured by the system. El Agente GLPI es un agente de gestión genérico. • https://github.com/glpi-project/glpi-agent/commit/9a97114f595562c91b0833b4a800dd51e9df65e9 • CWE-269: Improper Privilege Management •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28240 – GLPI-Agent's MSI package installation permits local users to change Agent configuration
https://notcve.org/view.php?id=CVE-2024-28240
25 Apr 2024 — The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit ... • https://github.com/glpi-project/glpi-agent/commit/41bbb1169e899bd15350a9e2fdbf9269a3b7a14f • CWE-20: Improper Input Validation •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34254 – Remote inventory task command injection when using ssh command mode
https://notcve.org/view.php?id=CVE-2023-34254
23 Jun 2023 — The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the age... • https://github.com/glpi-project/glpi-agent/blob/dd313ee0914becf74c0e48cb512765210043b478/Changes#L98 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •