CVE-2024-50339
Published: 12 December 2024
Summary
CVE-2024-50339 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Glpi-Project Glpi. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 4.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
GLPI, an open-source IT asset and service management application, contains a session management flaw in versions 9.5.0 through 10.0.16. An unauthenticated remote attacker can enumerate all active session identifiers, enabling the theft of any valid user session. The issue is tracked under CWE-287 and CWE-384 and carries a CVSS 4.0 score of 9.3.
Because the attack requires no credentials or user interaction, an adversary can obtain full access to any authenticated session, including those belonging to administrators. Successful exploitation grants the ability to view, modify, or delete arbitrary data within the GLPI instance and potentially pivot further into connected systems.
The project’s security advisory and the 10.0.17 release notes state that the vulnerability is resolved by updating to version 10.0.17 or later. The current EPSS score of 0.1976, with a recorded peak of 0.2196, indicates moderate and relatively stable exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-45179
Vulnerability details
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a…
more
patch for this issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing probes authentication mechanisms for bypasses, allowing identification and fixing of improper authentication issues.
Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.
Detects unauthorized successful logons resulting from improper authentication implementations.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Security awareness training instructs users on secure authentication practices and avoiding credential compromise.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.
Session content review can reveal authentication bypasses or failures in session establishment.