Description
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| glpi-project | GLPI | 10.0.0 – < 10.0.28, 11.0.0 – < 11.0.10 | 10.0.28 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | glpi | No fix yet | — |
References
- GitHub Security Advisory (GHSA-c46f-4v9j-5gpc) vendor-advisory
- Fix commit (11.0 branch) patch
- Fix commit (10.0 branch) patch
- VulnCheck Advisory: GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning third-party-advisory