CVE-2024-11955

GLPI index.php redirect

State: Published
Severity: 5.3 Medium
Published: Feb 25, 2025
Updated: Feb 25, 2025
Reserved: Nov 28, 2024

Description

A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument redirect leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.0.18 is able to address this issue. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N	VulDB

Weaknesses

CWE-601 Open Redirect

Affected Products

Product	Versions
GLPIn/a	10.0.0Affected 10.0.1Affected 10.0.2Affected 10.0.3Affected 10.0.4Affected 10.0.5Affected 10.0.6Affected 10.0.7Affected 10.0.8Affected 10.0.9Affected 10.0.10Affected 10.0.11Affected 10.0.12Affected 10.0.13Affected 10.0.14Affected 10.0.15Affected 10.0.16Affected 10.0.17Affected

References

VDB-296809 | GLPI index.php redirectvdb-entrytechnical-description
VDB-296809 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #451775 | GLPI-Project GLPI 10.0.17 Open Redirectthird-party-advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-g5fm-jq4j-c2c7related
https://github.com/glpi-project/glpi/releases/tag/10.0.18patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.