CVE-2021-39210
Medium
Description
GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie would be able to use it to autologin. This issue is fixed in version 9.5.6. As a workaround, one may avoid using the "remember me" feature.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Glpi
PublishedSep 15, 2021
First seenSep 15, 2021
Weakness typeCWE-1004CWE-1004
How to fix
Update
- glpi-project glpi9.5.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| glpi-project glpi | v < 9.5.6 | 9.5.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.