CVE-2024-29889

Deeper analysis

GLPI, an open-source IT asset management application, contains a SQL injection vulnerability in its saved searches feature that affects all versions prior to 10.0.15. The flaw, tracked as CWE-89, permits an authenticated user to inject arbitrary SQL through the saved-search handling code, resulting in unauthorized modification of other user account records. The issue carries a CVSS 3.1 base score of 7.1.

An authenticated attacker can leverage the injection to alter account data belonging to another user and thereby assume control of that account. Because the attack requires only low-privileged authenticated access and no user interaction, it can be executed remotely over the network with minimal preconditions.

The vulnerability is addressed in GLPI 10.0.15. The project’s security advisory GHSA-8xvf-v6vv-r75g and the associated commit 0a6b28be4c0f848106c60b554c703ec2e178d6c7 document the remediation and confirm that upgrading to the fixed release eliminates the injection vector.

The EPSS score for this CVE reached a peak of 0.7324 and currently stands at 0.6646, indicating sustained exploitation interest after disclosure.