CVE-2024-31705
Published: 29 April 2024
Summary
CVE-2024-31705 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-31705 is a remote code execution vulnerability in Infotel Conseil GLPI versions 10.x.x and later, stemming from insufficient validation of user-supplied input. The flaw is classified under CWE-78 and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.
An unauthenticated remote attacker can supply crafted input to trigger arbitrary command execution on the affected GLPI instance, potentially gaining full control over the application and underlying system.
Public references include a proof-of-concept repository and Full Disclosure mailing list posts that demonstrate exploitation via GLPI plugins, but the provided sources contain no details on official patches or mitigation steps. The associated EPSS score has remained flat at 0.0733 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29578
Vulnerability details
An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.