CVE-2024-27914: 
GLPI vulnerability analysis and mitigation

CVE-2024-27914 is a reflected Cross-Site Scripting (XSS) vulnerability affecting GLPI, a Free Asset and IT Management Software package. The vulnerability was discovered in versions prior to 10.0.13 and was disclosed on March 18, 2024. The issue affects GLPI installations where an unauthenticated user can provide a malicious link to a GLPI administrator that can be exploited through the debug bar (GLPI Advisory, NVD).

The vulnerability is classified as a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue. It has been assigned a CVSS v3.1 base score of 6.1 (Medium) by NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while GitHub assessed it with a score of 5.3 (Medium) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability specifically manifests when an administrator navigates through the debug bar after accessing a maliciously crafted link (NVD, GLPI Advisory).

The vulnerability allows an attacker to execute cross-site scripting attacks that could potentially lead to unauthorized access to sensitive information when successfully exploited against a GLPI administrator. The impact is limited to scenarios where the administrator interacts with the debug bar functionality (GLPI Advisory).

The vulnerability requires an unauthenticated attacker to craft a malicious link and convince a GLPI administrator to click on it and interact with the debug bar. The attack complexity is considered high due to these specific conditions that need to be met for successful exploitation (GLPI Advisory).

The vulnerability has been patched in GLPI version 10.0.13. Organizations are recommended to upgrade to this version to address the security issue. As a temporary workaround, administrators can disable the debug mode in their GLPI installation (GLPI Release, GLPI Advisory).

The vulnerability was part of a larger security update that addressed multiple security issues in GLPI. The French government's CERT (CERT-FR) issued an advisory about this vulnerability along with other security issues fixed in version 10.0.13 (CERT-FR).