CVE-2024-11955

MEDIUM

GLPI < 10.0.18 - Open Redirect via /index.php Redirect Parameter

Title source: llm
STIX 2.1

Description

A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument redirect leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.0.18 is able to address this issue. It is recommended to upgrade the affected component.

References (5)

Core 5
Core References
Permissions Required vdb-entry technical-description
https://vuldb.com/?id.296809
Permissions Required signature permissions-required
https://vuldb.com/?ctiid.296809
Exploit, Third Party Advisory third-party-advisory
https://vuldb.com/?submit.451775

Scores

CVSS v3 4.3
EPSS 0.0024
EPSS Percentile 47.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (1)
glpi-project/glpi 0.85 - 10.0.18
Published Feb 25, 2025
Tracked Since Feb 18, 2026