CVE-2025-21626

MEDIUM

GLPI 0.71-10.0.17 - Unauthenticated Exposure of Sensitive Information via status.php Endpoint

Title source: llm

Description

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/glpi-project/glpi/security/advisories/GHSA-5vvr-pxwf-3w77

Release Notes x_refsource_misc

https://github.com/glpi-project/glpi/releases/tag/10.0.18

Scores

CVSS v3 5.8

EPSS 0.0023

EPSS Percentile 45.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (1)

glpi-project/glpi 0.71 - 10.0.18

Published Feb 25, 2025

Tracked Since Feb 18, 2026