Skip to content
OpenAdvisories
High · 7.3 CVE-2024-28240 EUVD-2024-25348

GLPI-Agent's MSI package installation permits local users to change Agent configuration

Published Apr 25, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit GLPI-Agent related key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and add `SystemComponent` DWORD value setting it to `1` to hide GLPI-Agent from installed applications.

Affected products

VendorProductAffectedFixed
glpi-project glpi-agent < 1.7.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS glpi No fix yet —

References