CVE-2024-27930: 
GLPI vulnerability analysis and mitigation

GLPI (Gestionnaire Libre de Parc Informatique), a Free Asset and IT Management Software package for data center management, ITIL Service Desk, licenses tracking and software auditing, was found to contain a security vulnerability identified as CVE-2024-27930. The vulnerability affects versions from 0.78 up to (excluding) 10.0.13, and was discovered in February 2024 (GLPI Advisory).

The vulnerability allows an authenticated user to access sensitive fields data from any items in the system through dropdown menus, regardless of their privileges. The issue stems from insufficient validation of the 'displaywith' and 'condition' parameters in IDOR tokens, which could be exploited to access unauthorized data. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network vector attack with low complexity requiring low privileges (GLPI Advisory).

The vulnerability allows authenticated users to access sensitive information from any items in the system, including password hashes, tokens, and other confidential data that should be restricted based on user privileges. This could potentially lead to unauthorized access to sensitive system information (GLPI Pwned).

A proof-of-concept exploit has been published demonstrating how an attacker could abuse the dropdown functionality to extract sensitive information such as password hashes and email addresses. The vulnerability can be exploited by manipulating AJAX requests to the application's dropdown endpoints (GLPI Pwned).

The vulnerability has been patched in GLPI version 10.0.13. Organizations using affected versions should upgrade to this version immediately. The fix includes improved validation of 'displaywith' and 'condition' parameters in IDOR tokens and better filtering of sensitive fields (GLPI Release, GLPI Patch).