CVE-2021-21327 : GLPI is an open-source asset and IT management software package that provides IT

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”. As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors. This is fixed in version 9.5.4.

Published 2021-03-08 17:15:13

Updated 2023-06-26 19:20:39

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-21327

Glpi-project » Glpi
Versions before (<) 9.5.4
cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-21327

EPSS FAQ

5.70%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-21327

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None
6.8	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N	2.2	4.0	GitHub, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2021-21327

CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Assigned by: nvd@nist.gov (Primary)
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Assigned by: security-advisories@github.com (Secondary)

References for CVE-2021-21327

https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp

Unsafe Reflection in getItemForItemtype() · Advisory · glpi-project/glpi · GitHub
Vendor Advisory
http://packetstormsecurity.com/files/161680/GLPI-9.5.3-Unsafe-Reflection.html

GLPI 9.5.3 Unsafe Reflection ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://github.com/glpi-project/glpi/releases/tag/9.5.4

Release 9.5.4 · glpi-project/glpi · GitHub
Release Notes

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-21327

Products affected by CVE-2021-21327

Exploit prediction scoring system (EPSS) score for CVE-2021-21327

CVSS scores for CVE-2021-21327

CWE ids for CVE-2021-21327

References for CVE-2021-21327