GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.
References
Link | Resource |
---|---|
https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q | Third Party Advisory |
https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-09-25T19:19:15
Updated: 2019-09-26T11:49:33
Reserved: 2019-08-05T00:00:00
Link: CVE-2019-14666
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-09-25T20:15:10.777
Modified: 2020-08-24T17:37:01.140
Link: CVE-2019-14666
JSON object: View
Redhat Information
No data.
CWE