CVE-2024-31456

Deeper analysis

GLPI, an open-source IT asset management application, contains a SQL injection vulnerability in its map search functionality that affects all versions prior to 10.0.15. The flaw is tracked as CWE-89 and carries a CVSS 3.1 score of 7.7, reflecting network attack vector, low complexity, and low-privileged authenticated access that can result in high-impact confidentiality exposure with changed scope.

An authenticated user can supply crafted input through the map search feature to execute arbitrary SQL queries against the backend database. Successful exploitation allows the attacker to read sensitive data stored in GLPI without requiring user interaction or elevated privileges beyond a standard account.

The project’s security advisory and the referenced commit 730c3db29a1edc32f9b9d1e2a940e90a0211ab26 indicate that the issue is resolved in version 10.0.15; administrators are advised to upgrade promptly to obtain the fix.

The current EPSS score of 0.2396, with a recorded peak of 0.2443, indicates sustained but not sharply increasing public exploitation interest following disclosure.