CVE-2021-39211

MEDIUM EXPLOITED NUCLEI

GLPI 9.2-9.5.5 - Information Disclosure via Telemetry Endpoint

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-39211 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/telemetry.php`, which is not needed for usual functions of GLPI.

Nuclei Templates (1)

GLPI 9.2/<9.5.6 - Information Disclosure
MEDIUMby dogasantos,noraj
Shodan: http.title:"glpi" || http.favicon.hash:"-1474875778"
FOFA: icon_hash="-1474875778" || title="glpi"

References (2)

Core 2
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/glpi-project/glpi/releases/tag/9.5.6

Scores

CVSS v3 5.3
EPSS 0.0445
EPSS Percentile 90.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

VulnCheck KEV 2023-11-13
CWE
CWE-200
Status published
Products (1)
glpi-project/glpi 9.2 - 9.5.6
Published Sep 15, 2021
Tracked Since Feb 18, 2026