CVE-2021-21255
Summary
| CVE | CVE-2021-21255 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-03-02 20:15:00 UTC |
| Updated | 2022-10-14 13:01:00 UTC |
| Description | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4. |
Risk And Classification
Problem Types: CWE-639
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Glpi-project | Glpi | 9.5.3 | All | All | All |
| Application | Glpi-project | Glpi | 9.5.3 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| validate entity_restrict when available with idor tokens · glpi-project/glpi@aade65b · GitHub | MISC | github.com | Patch, Third Party Advisory |
| entities switch IDOR · Advisory · glpi-project/glpi · GitHub | CONFIRM | github.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.