The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the agent is configured with for remoteinventory task. This vulnerability has been patched in glpi-agent 1.5.
References
Configurations
History
21 Nov 2024, 08:06
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.6 |
| References | () https://github.com/glpi-project/glpi-agent/blob/dd313ee0914becf74c0e48cb512765210043b478/Changes#L98 - Patch | |
| References | () https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-39vc-hxgm-j465 - Mitigation, Vendor Advisory |
05 Jul 2023, 16:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:glpi-project:glpi_agent:*:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-39vc-hxgm-j465 - Mitigation, Vendor Advisory | |
| References | (MISC) https://github.com/glpi-project/glpi-agent/blob/dd313ee0914becf74c0e48cb512765210043b478/Changes#L98 - Patch | |
| First Time |
Glpi-project glpi Agent
Glpi-project |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
23 Jun 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-23 21:15
Updated : 2024-11-21 08:06
NVD link : CVE-2023-34254
Mitre link : CVE-2023-34254
CVE.ORG link : CVE-2023-34254
JSON object : View
Products Affected
glpi-project
- glpi_agent
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')