Attacker Value
Low
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
1

CVE-2021-39211

Disclosure Date: September 15, 2021
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file ajax/telemetry.php, which is not needed for usual functions of GLPI.

Add Assessment

2
Ratings
Technical Analysis

It gives GLPI version, the list of all plugins and their version, and some system info like the database used and its version, sometimes the webserver engine, the PHP version and the list of all PHP modules loaded, the OS distro and version + the kernel name and version.

CVSS V3 Severity and Metrics
Base Score:
5.3 Medium
Impact Score:
1.4
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
Low
Integrity (I):
None
Availability (A):
None

General Information

Vendors

  • glpi-project

Products

  • glpi

Additional Info

Technical Analysis