CVE-2024-27937: 
GLPI vulnerability analysis and mitigation

GLPI (Gestionnaire Libre de Parc Informatique), a Free Asset and IT Management Software package for data center management, ITIL Service Desk, licenses tracking and software auditing, was found to contain a vulnerability identified as CVE-2024-27937. The vulnerability was discovered in versions 10.0.0 through 10.0.12 and was patched in version 10.0.13, released on March 13, 2024 (GLPI Release).

The vulnerability allows an authenticated user to obtain email addresses of all GLPI users through improper authorization controls. The issue received a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and high impact on confidentiality (GitHub Advisory).

The vulnerability enables authenticated users to access and enumerate email addresses of all users in the GLPI system, regardless of their privilege level or entity restrictions. This represents a significant privacy concern and potential data breach risk (GitHub Advisory).

A detailed proof of concept has been published demonstrating how the vulnerability can be exploited by using the built-in post-only account to enumerate users and their email addresses through AJAX calls to /ajax/actors.php. The exploit involves manipulating the entity_restrict parameter to access user information across different entities (Security Blog).

The vulnerability has been patched in GLPI version 10.0.13. Organizations using affected versions should upgrade immediately to the patched version. The fix includes improved entity restriction filtering in dropdowns to match active entities and proper handling of string values in entities filtering (GLPI Patch).