pluginsGLPI addressing 3.0.0/3.0.1/3.0.2 IP Report externally-controlled input to select classes or code

Summaryinfo

A vulnerability marked as critical has been reported in pluginsGLPI addressing 3.0.0/3.0.1/3.0.2. This affects an unknown function of the component IP Report Handler. This manipulation causes use of externally-controlled input to select classes or code. This vulnerability appears as CVE-2024-53850. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in pluginsGLPI addressing 3.0.0/3.0.1/3.0.2 and classified as critical. Affected by this vulnerability is an unknown code of the component IP Report Handler. The manipulation with an unknown input leads to a use of externally-controlled input to select classes or code vulnerability. The CWE definition for the vulnerability is CWE-470. The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.0 and before 3.0.3, a poor security check allows an unauthenticated attacker to determine whether data exists (by name) in GLPI.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-53850 since 11/22/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.0.3 eliminates this vulnerability. Applying the patch b334187a99206abbd7d0bc84f720b0a6e69e92f0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Asset Management Software

Vendor

• pluginsGLPI

Name

• addressing

Version

• 3.0.0
• 3.0.1
• 3.0.2

License

• open-source

Website

• Product: https://github.com/pluginsGLPI/addressing/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion