What’s Vulnerable › Vulnerabilities

CVE-2019-10477

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-29 · updated 2026-06-17
• Weakness: CWE-19

Description

The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions.

Affected products

• Fusioninventory: before 1.4; before 1.1 — fixed in 1.1, 1.4

How to fix

Upgrade to a fixed version: Fusioninventory 1.1, 1.4. Check the vendor advisory for mitigations.

References

• https://github.com/fusioninventory/fusioninventory-for-glpi/commit/0f777f85773b18f5252e79afa1929fcdc4858c3a
• https://github.com/fusioninventory/fusioninventory-for-glpi/compare/260a864...e1f776d
• https://github.com/fusioninventory/fusioninventory-for-glpi/compare/cec774a...baa4158
• https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.3%2B1.4
• https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.4%2B1.1
• https://github.com/fusioninventory/fusioninventory-for-glpi/commit/0f777f85773b18f5252e79afa1929fcdc4858c3a
• https://github.com/fusioninventory/fusioninventory-for-glpi/compare/260a864...e1f776d
• https://github.com/fusioninventory/fusioninventory-for-glpi/compare/cec774a...baa4158
• https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.3%2B1.4
• https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.4%2B1.1

Get alerted when CVE-2019-10477 or the next vulnerability affects your stack