CVE-2024-50339

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-79CWE-287CWE-384

Affected software

No affected versions have been published.

Timeline

Published
Dec 12, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-50348.8The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perforCVE-2024-503407.3symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_aCVE-2024-503413.1symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the SymCVE-2024-503424.3symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynCVE-2024-503433.1symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` CVE-2024-503444.6I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they haveCVE-2024-503456.1symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `RCVE-2024-503465.1WebFeed is a lightweight web feed reader extension for Firefox/Chrome. Multiple HTML injection vulnerabilities in WebFeed can lead to CSRF aCVE-2024-503476.3Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verifiCVE-2024-503485.4InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validatioCVE-2024-503494.7Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations andCVE-2024-50358.8The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/