CVE-2021-39210

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue is fixed in version 9.5.6. As a workaround, one may avoid using the "remember me" feature.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1004 CWE-732

Affected software

Vendor	Product	Versions
glpi-project	glpi	< 9.5.6

References

https://github.com/glpi-project/glpi/releases/tag/9.5.6Release Notes, Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-hwxq-4c5f-m4v2Third Party Advisory
https://huntr.dev/bounties/b2e99a41-b904-419f-a274-ae383e4925f2/Third Party Advisory
https://github.com/glpi-project/glpi/releases/tag/9.5.6Release Notes, Third Party Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-hwxq-4c5f-m4v2Third Party Advisory
https://huntr.dev/bounties/b2e99a41-b904-419f-a274-ae383e4925f2/Third Party Advisory

Timeline

Published: Sep 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392115.3GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint disclose CVE-2021-392123.6ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribut CVE-2021-392138.8GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is v CVE-2021-392149.8mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perfo CVE-2021-392157.5Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical a CVE-2021-392166.3Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-f CVE-2021-392177.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary comman CVE-2021-392186.3Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory CVE-2021-392196.3Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As CVE-2021-39227.0A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.CVE-2021-392203.5Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by de CVE-2021-392215.4Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to