CVE-2024-50339

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-50339
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50339.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-50339
Aliases
  • GHSA-v977-g4r9-6r72
Downstream
Published
2024-12-11T17:48:42Z
Modified
2025-10-30T20:29:57.518589Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
GLPI vulnerable to unauthenticated session hijacking
Details

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-287",
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
9fa6de558a9987561b80afd57a796a3fa19deee6
Fixed
08ee4d266768dc1f76cb6c716d7fd118d39676d9

Affected versions

10.*

10.0.0
10.0.0-beta
10.0.0-rc1
10.0.0-rc2
10.0.0-rc3
10.0.1
10.0.10
10.0.11
10.0.12
10.0.13
10.0.14
10.0.15
10.0.16
10.0.2
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7
10.0.8
10.0.9

9.*

9.5.0
9.5.1
9.5.2
9.5.3
9.5.4
9.5.5
9.5.6
9.5.7