CVE-2024-45608

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.17

Description The issue is related to a lack of protection against SQL injection attacks. An authenticated user can perform a SQL injection by changing their preferences. This could allow a remote attacker to execute SQL injections.

Recommendations For versions prior to 10.0.17, upgrade to version 10.0.17 to resolve the issue. As a temporary workaround, consider restricting access to preference changes for authenticated users until the upgrade is applied.