CVE-2021-39213

Summary

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable API Rest as a workaround.

Impact & exploitability

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products we track (1)

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

• NVD record
• https://github.com/glpi-project/glpi/releases/tag/9.5.6Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-6w9f-2m6g-5777Advisory