PT-2022-10890

CVE-2021-39190

Published

2022-09-22

Updated

2023-07-17

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SCCM plugin for GLPI versions prior to 2.3.0

Description The SCCM plugin for GLPI has an issue where the Configuration page is publicly accessible in read-only mode in versions prior to 2.3.0. This issue is patched in version 2.3.0.

Recommendations For versions prior to 2.3.0, update to version 2.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the Configuration page until the update is applied.

Exploitability

Fix

Impacts

Researchers

Cedric-Anne

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-862: Missing Authorization

Related identifiers

CVE-2021-39190