CVE-2024-47758

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Dec 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-477594.8GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then CVE-2024-47768.2A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability affects Firefox < 126 CVE-2024-477608.8GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access CVE-2024-477617.2GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access CVE-2024-477625.8Backstage is an open framework for building developer portals. Configuration supplied through APP_CONFIG_* environment variables, for exampl CVE-2024-477635.5Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can resul CVE-2024-477646.9cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resul CVE-2024-477656.1Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting CVE-2024-477664.9Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap CVE-2024-477674.3Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.113, Tuleap CVE-2024-477688.1Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account CVE-2024-477697.5IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference u