CVE-2023-35940
Published: 05 July 2023
Summary
CVE-2023-35940 is a high-severity Improper Access Control (CWE-284) vulnerability in Glpi-Project Glpi. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 32.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-39924
Vulnerability details
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains…
more
a patch for this issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Provides capability to review session content, directly detecting violations of access control.
Control assessments verify that access controls are implemented correctly and operating as intended, detecting improper access control before exploitation.
Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.
Requires explicit authorization before any identifier can be assigned, preventing missing authorization.
The policy establishes consistent rules for granting, reviewing, and revoking access based on personnel status, tangibly limiting improper access control.
Defining security roles/responsibilities and integrating risk management into the SDLC directly reduces improper access control by ensuring access decisions are designed and reviewed throughout development.
Decoy resources detect and deflect attempts to bypass access controls by attracting and monitoring attackers on fake assets.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.