← Retour aux CVEs

CVE-2021-43779

CRITICAL

9.9

Description

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.

Details CVE

Score CVSS v3.19.9

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie1/5/2022

Derniere modification9/8/2025

Sourcenvd

Observations honeypot0

Produits affectes

teclib-edition:addressing

Faiblesses (CWE)

CWE-20CWE-78

References

https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin(security-advisories@github.com)

https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366(security-advisories@github.com)

https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh(security-advisories@github.com)

https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.