CVE-2024-27098
Published: 18 March 2024
Summary
CVE-2024-27098 is a medium-severity SSRF (CWE-918) vulnerability in Glpi-Project Glpi. Its CVSS base score is 6.4 (Medium).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
GLPI, a free asset and IT management software package used for data center management, ITIL service desk functions, license tracking, and software auditing, is affected by CVE-2024-27098. The flaw allows an authenticated user to perform a server-side request forgery attack through arbitrary object instantiation, corresponding to CWE-918, and carries a CVSS 3.1 score of 6.4 reflecting network attack vector, low complexity, and limited impacts on confidentiality and integrity across a security boundary.
An authenticated attacker can leverage the vulnerability to initiate SSRF requests from the GLPI server, potentially reaching internal resources or external systems that would otherwise be inaccessible, without requiring user interaction.
The project has released version 10.0.13 to address the issue, with the fix documented in the associated GitHub security advisory and commit that resolves the arbitrary object instantiation path. The EPSS score has remained near 0.14 with only minimal variation between its current and peak values.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-24350
Vulnerability details
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in…
more
version 10.0.13.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.