CVE-2024-28241
GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which involves installed folder is automatically secured by the system.
El Agente GLPI es un agente de gestión genérico. Antes de la versión 1.7.2, un usuario local podía modificar el código GLPI-Agent o usar DLL para modificar la lógica del agente e incluso obtener mayores privilegios. Los usuarios deben actualizar a GLPI-Agent 1.7.2 para recibir un parche. Como workaround, utilice la carpeta de instalación predeterminada, que implica que el sistema protege automáticamente la carpeta instalada.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-03-07 CVE Reserved
- 2024-04-25 CVE Published
- 2024-04-26 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://github.com/glpi-project/glpi-agent/commit/9a97114f595562c91b0833b4a800dd51e9df65e9 | X_refsource_misc | |
| https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-3268-p58w-86hw | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Glpi-project Search vendor "Glpi-project" | Glpi-agent Search vendor "Glpi-project" for product "Glpi-agent" | < 1.7.2 Search vendor "Glpi-project" for product "Glpi-agent" and version " < 1.7.2" | en |
Affected
| ||||||