CVE-2021-39213: 
GLPI vulnerability analysis and mitigation

GLPI, a free Asset and IT management software package, was found to contain a vulnerability (CVE-2021-39213) affecting versions 9.1 through 9.5.5 when API Rest is enabled. The vulnerability allows API bypass through custom header injection. The issue was discovered and disclosed in September 2021, with a fix released in version 9.5.6 (GitHub Advisory).

The vulnerability is classified as a custom header injection issue that could lead to API bypass in GLPI installations with REST API enabled. The flaw is tracked as CWE-74, suggesting it's related to improper input validation. The vulnerability specifically allows bypassing IP restrictions on the GLPI API through custom header injection techniques (GitHub Advisory).

When exploited, the vulnerability allows attackers to bypass IP restrictions implemented on the GLPI API, potentially leading to unauthorized access to the API endpoints. This could compromise the security controls put in place to limit API access to specific IP addresses (GitHub Advisory).

The vulnerability has been fixed in GLPI version 9.5.6. Organizations are recommended to upgrade to this version or later. For those unable to upgrade immediately, a temporary workaround is available by disabling the API Rest functionality (GitHub Advisory, GLPI Release).