CVE-2021-39213

Опубликовано: 15 сент. 2021

Источник: nvd

CVSS3: 6.8

CVSS3: 8.8

CVSS2: 6

EPSS Низкий

Описание

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable API Rest as a workaround.

Ссылки

https://github.com/glpi-project/glpi/releases/tag/9.5.6
Release Notes
Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-6w9f-2m6g-5777
Third Party Advisory
https://github.com/glpi-project/glpi/releases/tag/9.5.6
Release Notes
Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-6w9f-2m6g-5777
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

Версия от 9.1 (включая) до 9.5.6 (исключая)

EPSS

Процентиль: 57%

0.00351

Низкий

6.8 Medium

CVSS3

8.8 High

CVSS3

6 Medium

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2021-39213

CVSS3: 6.8

ubuntu

больше 4 лет назад

CVE-2021-39213

CVSS3: 6.8

debian

больше 4 лет назад

GLPI is a free Asset and IT management software package. Starting in v ...

EPSS

Процентиль: 57%

0.00351

Низкий

6.8 Medium

CVSS3

8.8 High

CVSS3

6 Medium

CVSS2

Дефекты

CWE-74