GLPI dropdown values endpoint SQL injection flaw
Logged-in users of this IT management web program can peek at internal data.
Summary
GLPI, an IT asset and management software package, has an SQL injection flaw in its dropdown values endpoint. Any logged-in user can exploit it, affecting versions from 9.4.0 until 10.0.26 and 11.0.8.
Affected when
- GLPI login account
What to do
Update to GLPI 11.0.8 or 10.0.26 or later.
Update to at least the version for your product:
- GLPI 11 11.0.8 or later
- GLPI 10 10.0.26 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen