CVE-2024-43416

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Nov 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-434176.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-434186.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-43425.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, iCVE-2024-434205.6Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel AtoCVE-2024-434239.8The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.CVE-2024-434247.5Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requestsCVE-2024-434258.1A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: TCVE-2024-434267.5A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeXCVE-2024-434273.7A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded fCVE-2024-434287.1To address a cache poisoning risk in Moodle, additional validation for local storage was required.CVE-2024-434295.3A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view CVE-2024-43439.8A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custo