CVE-2024-27937
Assigner: GitHub_M
Published: 2024-03-18T15:17:18.178Z
State: PUBLISHED
title: glpi Users emails enumeration
problemTypes: descriptions: cweId: CWE-285
description: CWE-285: Improper Authorization
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
affected: vendor: glpi-project
product: glpi
versions: version: >= 10.0.0, < 10.0.13
status: affected
descriptions: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

source: advisory: GHSA-98qw-hpg3-2hpj
discovery: UNKNOWN