CVE-2024-11955: A vulnerability was found in GLPI up to
10.0.17. It has been declared as problematic. Affected by
this vulnerability is an unknown functionality of the file
/index.php.
The manipulation of the argument redirect leads to
open redirect. The attack can be launched remotely.
The exploit has been disclosed to the public and
may be used. Upgrading to version 10.0.18 is able to
address this issue.
It is recommended to upgrade the affected component.
CVE-2025-23024: Starting in version 0.72 and prior to
version 10.0.18, an anonymous user can disable all the
active plugins. Version 10.0.18 contains a patch.
As a workaround, one may delete the `install/update.php`
file.
CVE-2025-23046: Prior to version 10.0.18, a low privileged
user can enable debug mode and access sensitive information.
Version 10.0.18 contains a patch.
As a workaround, one may delete the `install/update.php`
file.
CVE-2025-25192: Starting in version 9.5.0 and prior to
version 10.0.18, if a "Mail servers"
authentication provider is configured to use an Oauth
connection provided by the OauthIMAP plugin, anyone can
connect to GLPI using a user name on which an Oauth
authorization has already been established.
Version 10.0.18 contains a patch. As a
workaround, one may disable any "Mail
servers" authentication provider configured to
use an Oauth connection provided by the OauthIMAP
plugin.
CVE-2025-21626: Starting in version 0.71 and prior to
version 10.0.18, an anonymous user can fetch sensitive
information from the `status.php` endpoint.
Version 10.0.18 contains a fix for the issue.
Some workarounds are available. One may delete the
`status.php` file, restrict its access, or
remove any sensitive values from the `name` field of
the active LDAP directories, mail servers authentication
providers and mail receivers.
CVE-2025-21627: In versions prior to 10.0.18, a malicious
link can be crafted to perform a reflected XSS attack on the
search page. If the anonymous ticket creation is enabled,
this attack can be performed by an unauthenticated
user. Version 10.0.18 contains a fix for the issue.
CVE-2025-21619: An administrator user can perfom a SQL
injection through the rules configuration forms.
This vulnerability is fixed in 10.0.18.
CVE-2025-24799: An unauthenticated user can perform a SQL
injection through the inventory endpoint.
This vulnerability is fixed in 10.0.18.
CVE-2025-24801: An authenticated user can upload and force
the execution of *.php files located on the GLPI server.
This vulnerability is fixed in 10.0.18.