Cyber Resilience

CVE-2024-37149

RCE in Glpi-Project Glpi 0.85 – 10.0.16

Published
10 July 2024
Modified
07 January 2025
Patch / advisory
CVSS Score v3.1 7.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.21 97th percentile
Risk Priority 66 floored blend · peak EPSS

Summary

CVE-2024-37149 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Glpi-Project Glpi. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

GLPI, an open-source asset and IT management software package providing ITIL Service Desk features along with license tracking and software auditing, contains a vulnerability tracked as CVE-2024-37149. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute arbitrary code on the server. The flaw is associated with CWE-73 and CWE-94 and is rated 7.2 under CVSS 3.1.

An attacker possessing technician credentials can exploit the issue remotely with low attack complexity and no user interaction required, resulting in full control over confidentiality, integrity, and availability of the GLPI instance.

The referenced GitHub security advisories for the project state that the vulnerability is resolved by upgrading to version 10.0.16.

The associated EPSS score has remained flat at 0.0833 with no material rise after disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious…

more

script. Upgrade to 10.0.16.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
T1059.001 PowerShell Execution
Adversaries may abuse PowerShell commands and scripts for execution.
T1059.002 AppleScript Execution
Adversaries may abuse AppleScript for execution.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1059.005 Visual Basic Execution
Adversaries may abuse Visual Basic (VB) for execution.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-27756Same product: Glpi-Project Glpi
CVE-2026-26026Same product: Glpi-Project Glpi
CVE-2026-25636Shared CWE-73, CWE-94
CVE-2026-13014Shared CWE-73, CWE-94
CVE-2026-65941Shared CWE-73, CWE-94
CVE-2026-1340Shared CWE-94
CVE-2024-54724Shared CWE-94
CVE-2013-3906Shared CWE-94
CVE-2023-25261Shared CWE-94
CVE-2026-16144Shared CWE-94

Affected Assets

glpi-project
glpi
0.85 — 10.0.16

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.3.2
  • V1.3.1

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation finds code paths that accept and execute externally influenced strings.

Input validation directly rejects or sanitizes untrusted path strings before they reach filesystem operations.

Enforces authorization checks on the actual resource accessed, blocking unauthorized files even when a malicious path is supplied.

Least-privilege limits the set of files or directories any subject can affect, shrinking the blast radius of a path-control flaw.

Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices include input validation and path sanitization that eliminate this weakness.

PR.AA-05 mostly match
prevents

Least-privilege file authorization directly limits damage from externally controlled paths.

PR.DS-10 none match
prevents

PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect path-traversal issues but does not itself implement preventive controls.

prevents

Secure development lifecycle mandates input validation and path-handling controls that directly prevent external file/path manipulation.

prevents

Application security requirements explicitly call for controls against untrusted input influencing file operations.

prevents

Secure architecture principles discourage unsafe path construction but do not prescribe concrete file-name controls.

prevents

Secure coding standards require canonicalization, allow-listing, and bounds checks on file paths, directly eliminating CWE-73.

mitigates

Information access restriction limits which files can be reached, indirectly reducing impact of path manipulation.

References