CVE-2021-43779 | BDVDB-2026-167173 Detail
pluginsGLPIaddressing
Description#
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact high. Attack vector: network.
Weaknesses#
- CWE-20 Improper Input Validation
References#
- https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh
- https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366
- https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin
- https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.