CVE-2024-48912

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
GitHub_MCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
glpi-projectglpi
10.0.0 ≤
𝑥
< 10.0.17
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
glpi
questing
dne
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/glpi-project/glpi/releases/tag/10.0.17
https://github.com/glpi-project/glpi/security/advisories/GHSA-vjmw-j32j-ph4f