What’s Vulnerable › Vulnerabilities

CVE-2022-24867: LDAP password exposure in glpi

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-21 · updated 2026-06-17
• Weakness: CWE-200

Description

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.

Affected products

• glpi-project glpi: before 10.0.0 — fixed in 10.0.0

How to fix

Upgrade to a fixed version: glpi-project glpi 10.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e
• https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr
• https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e
• https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr

Get alerted when CVE-2022-24867 or the next vulnerability affects your stack