CVE-2023-34107

MEDIUM

GLPI 9.2.0-10.0.7 - Authenticated Incorrect Access Control in KnowbaseItems

Title source: llm

Description

GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/glpi-project/glpi/security/advisories/GHSA-966h-xrf5-pmj4

Release Notes x_refsource_misc

https://github.com/glpi-project/glpi/releases/tag/10.0.8

Scores

CVSS v3 6.5

EPSS 0.0024

EPSS Percentile 46.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284 CWE-863

Status published

Products (1)

glpi-project/glpi 9.2.0 - 10.0.8

Published Jul 05, 2023

Tracked Since Feb 18, 2026