What’s Vulnerable › Vulnerabilities

CVE-2024-23645: GLPI reflected XSS in reports pages

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-01 · updated 2026-06-17
• Weakness: CWE-79

Description

GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.

Affected products

• glpi-project glpi: from 0.65 before 10.0.12 — fixed in 10.0.12

How to fix

Upgrade to a fixed version: glpi-project glpi 10.0.12. Check the vendor advisory for mitigations.

References

• https://github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0
• https://github.com/glpi-project/glpi/commit/fc1f6da9d158933b870ff374ed3a50ae98dcef4a
• https://github.com/glpi-project/glpi/releases/tag/10.0.12
• https://github.com/glpi-project/glpi/security/advisories/GHSA-2gj5-qpff-ff3x
• https://github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0
• https://github.com/glpi-project/glpi/commit/fc1f6da9d158933b870ff374ed3a50ae98dcef4a
• https://github.com/glpi-project/glpi/releases/tag/10.0.12
• https://github.com/glpi-project/glpi/security/advisories/GHSA-2gj5-qpff-ff3x

Get alerted when CVE-2024-23645 or the next vulnerability affects your stack