CVE-2023-23610 — glpi vulnerable to Unauthorized access to data export
GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the stand…
Published: 2023-01-25 · CVSS: 6.5 · CVSS 3.1
GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...). This issue is patched in 10.0.6.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7