CVE-2021-21255

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862 CWE-639

Affected software

Vendor	Product	Versions
glpi-project	glpi	= 9.5.3

References

https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dcPatch, Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-v3m5-r3mx-ff9jThird Party Advisory
https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dcPatch, Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-v3m5-r3mx-ff9jThird Party Advisory

Timeline

Published: Mar 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-212577.5Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations i CVE-2021-212585.4GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud CVE-2021-212596.1HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker CVE-2021-21266.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-212605.4Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers cre CVE-2021-212618.8Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-po CVE-2021-212635.3Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This sam CVE-2021-212645.2October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/47 CVE-2021-212657.5October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running o CVE-2021-212665.0openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the X CVE-2021-212677.5Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email a CVE-2021-212696.5Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint