CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28241 – GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder
https://notcve.org/view.php?id=CVE-2024-28241
25 Apr 2024 — The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which involves installed folder is automatically secured by the system. El Agente GLPI es un agente de gestión genérico. • https://github.com/glpi-project/glpi-agent/commit/9a97114f595562c91b0833b4a800dd51e9df65e9 • CWE-269: Improper Privilege Management •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28240 – GLPI-Agent's MSI package installation permits local users to change Agent configuration
https://notcve.org/view.php?id=CVE-2024-28240
25 Apr 2024 — The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit ... • https://github.com/glpi-project/glpi-agent/commit/41bbb1169e899bd15350a9e2fdbf9269a3b7a14f • CWE-20: Improper Input Validation •