CVE-2023-34254: Remote inventory task command injection when using ssh command mode

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-23 · updated 2026-06-17
Weakness: CWE-78

Description

The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the agent is configured with for remoteinventory task. This vulnerability has been patched in glpi-agent 1.5.

Affected products

glpi-project glpi-agent: before 1.5 — fixed in 1.5

How to fix

Upgrade to a fixed version: glpi-project glpi-agent 1.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-34254 or the next vulnerability affects your stack