← CVE Intelligence

CVE-2024-47759

GLPI has a stored XSS via document upload PUBLISHED

Description (CNA)

GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when any user will try to see the document contents. Upgrade to 10.0.17.

Affected (CNA)

Vendor / productVersions
glpi-project / glpiaffected >= 9.2.0, < 10.0.17

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.