CVE-2024-27937

🎯 CVE-2024-27937 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2024-27937 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

Klassifikation & Betroffenheit:

CWE-285 glpi-project glpi 10.0.0, < 10.0.13glpi -glpi-project glpi *

Improper Authorization 🎯 High

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

🛡️ Empfohlene Mitigation: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authoriza…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-1 · Accessing Functionality Not Properly Con… (High) CAPEC-13 · Subverting Environment Variable Values (Very High) CAPEC-17 · Using Malicious Files (Very High) CAPEC-39 · Manipulating Opaque Client-based Data To… (Medium) CAPEC-45 · Buffer Overflow via Symbolic Links (High) CAPEC-104 · Cross Zone Scripting (High) CAPEC-127 · Directory Indexing (Medium) CAPEC-402 · Bypassing ATA Password Security

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1574.010 · Hijack Execution Flow: ServicesFil… T1562.003 · Impair Defenses:Impair Command His… T1574.006 · Hijack Execution Flow:Dynamic Link… T1574.007 · Hijack Execution Flow:Path Interce… T1574.005 · Hijack Execution Flow: Executable … T1083 · File and Directory Discovery

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2022-4062 7.8 CVE-2020-11031 7.8 CVE-2026-49470 7.7 CVE-2024-31456 7.7 CVE-2024-27096 7.7

🩹 Patch verfügbar (OSV):

🩹 ba1f4be9d43f7ec193ef3401f11cc79efc24ca56 (Commit) 🩹 d02c537d23cbb729fe18b87f71b3c6e84e9892da (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2024

Veröffentlicht 03/2024

Heute 31.10.

CVSS-Vektor-Analyse: 6.5

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Keine

A · Verfügbarkeit Keine

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CNA-Bewertung (GitHub_M): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Veröffentlicht:18.03.2024

Aktualisiert:17.06.2026 07:20

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2024-25111

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-285 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	744	0,2 %
≥50 %	3.225	0,8 %
≥10 %	22.059	5,8 %
<10 %	354.701	93,2 %

6.5 MEDIUM

EPSS

27.1%

CVE-2024-27937 🌐 Netzwerk (Remote) 🔑 Geringe Nutzerrechte nötig

glpi-project

CVE-2024-27937 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

CWE-285 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 2 Jahren ↻ vor 2 Jahren

🛡️ Details ➔

CVE-2024-27937 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

Zero-Day & Vulnerability Intelligence Hub

CVE-2024-27937 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.