CVE-2025-23024

MEDIUM

GLPI 0.72-10.0.18 - Unauthenticated Plugin Disabling via install/update.php

Title source: llm

Description

GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/glpi-project/glpi/security/advisories/GHSA-885x-hvp2-85q8

Release Notes x_refsource_misc

https://github.com/glpi-project/glpi/releases/tag/10.0.18

Scores

CVSS v3 4.3

EPSS 0.0016

EPSS Percentile 36.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-285

Status published

Products (1)

glpi-project/glpi 0.72 - 10.0.18

Published Feb 25, 2025

Tracked Since Feb 18, 2026