CVE-2023-28634

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.5.13 GLPI versions prior to 10.0.7

Description The issue is related to a lack of authorization, allowing a user with the Technician profile to view and generate a personal token for a Super-Admin. This can be exploited to negotiate a GLPI session and hijack the Super-Admin account, resulting in a privilege escalation.

Recommendations For versions prior to 9.5.13, update to version 9.5.13 or later to resolve the issue. For versions prior to 10.0.7, update to version 10.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the personal token generation feature for users with the Technician profile until a patch is applied.