CVE-2015-7685

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.85.3

Description The issue allows remote authenticated users to create super-admin accounts. This is achieved by leveraging permissions to create a user and the profiles id parameter to the "front/user.form.php" endpoint.

Recommendations For versions prior to 0.85.3, update to version 0.85.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "front/user.form.php" endpoint and limiting the ability to create new users until the update is applied.