CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28241 – GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder
https://notcve.org/view.php?id=CVE-2024-28241
The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which involves installed folder is automatically secured by the system. El Agente GLPI es un agente de gestión genérico. • https://github.com/glpi-project/glpi-agent/commit/9a97114f595562c91b0833b4a800dd51e9df65e9 https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-3268-p58w-86hw • CWE-269: Improper Privilege Management •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28240 – GLPI-Agent's MSI package installation permits local users to change Agent configuration
https://notcve.org/view.php?id=CVE-2024-28240
The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit GLPI-Agent related key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and add `SystemComponent` DWORD value setting it to `1` to hide GLPI-Agent from installed applications. • https://github.com/glpi-project/glpi-agent/commit/41bbb1169e899bd15350a9e2fdbf9269a3b7a14f https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-hx3x-mmqg-h3jp • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27914 – Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI
https://notcve.org/view.php?id=CVE-2024-27914
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. • https://github.com/glpi-project/glpi/commit/69e0dee8de0c0df139b42dbfa1a8997888c2af95 https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-rcxj-fqr4-q34r • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27104 – Stored XSS in dashboards in GLPI
https://notcve.org/view.php?id=CVE-2024-27104
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. • https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65 https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27098 – Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI
https://notcve.org/view.php?id=CVE-2024-27098
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede ejecutar un ataque basado en SSRF utilizando la creación de instancias de objetos arbitrarios. • https://github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484 https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w • CWE-918: Server-Side Request Forgery (SSRF) •