CVE-2021-39209

Bypassable CSRF protection

State: Published
Severity: 8.8 High
Published: Sep 15, 2021
Updated: Aug 4, 2024
Reserved: Aug 16, 2021

Description

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many actions on GLPI. This issue is fixed in version 9.5.6. There are no workarounds aside from upgrading.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
glpiglpi-project	< 9.5.6Affected

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-5qpf-32w7-c56p
https://github.com/glpi-project/glpi/releases/tag/9.5.6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.