CVE-2019-14666

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-09-25 · updated 2026-06-17
Weakness: CWE-200

Description

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.

Affected products

glpi-project glpi: through 9.4.3

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q
https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt
https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q
https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt

Get alerted when CVE-2019-14666 or the next vulnerability affects your stack