CRITICAL🇵🇱 Wersja polska

CVE-2024-50339

CVSS 9.3v4.0pub. 2024-12-12upd. 2025-01-10

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The error results from improper access control to session identifiers (CWE-287, CWE-384), allowing an unauthenticated person to retrieve a list of all active sessions in the system. An attacker can then use the obtained session identifier to impersonate a logged-in user — including an administrator. The vulnerability has existed since version 9.5.0 and does not require any interaction from the victim.

Impact

An attacker can hijack any active session of a user or GLPI system administrator, gaining full access to managed IT resources and data without knowing the password. Combined with the CWE-79 (XSS) designation, there is also a risk of executing malicious scripts in the context of the hijacked session.

Mitigation & patch

GLPI should be updated to version 10.0.17, which contains a patch eliminating this vulnerability. The patch is available in the official project repository at: https://github.com/glpi-project/glpi/releases/tag/10.0.17

Who is affected

GLPI in versions from 9.5.0 to earlier than 10.0.17

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X