Cyber Resilience

CVE-2024-31705

CriticalRCE

Published: 29 April 2024

Published
29 April 2024
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0733 91.9th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-31705 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-31705 is a remote code execution vulnerability in Infotel Conseil GLPI versions 10.x.x and later, stemming from insufficient validation of user-supplied input. The flaw is classified under CWE-78 and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.

An unauthenticated remote attacker can supply crafted input to trigger arbitrary command execution on the affected GLPI instance, potentially gaining full control over the application and underlying system.

Public references include a proof-of-concept repository and Full Disclosure mailing list posts that demonstrate exploitation via GLPI plugins, but the provided sources contain no details on official patches or mitigation steps. The associated EPSS score has remained flat at 0.0733 with no material increase since disclosure.

EU & UK References

Vulnerability details

An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References