Vulnerability Description
The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech category. For example, plugins/dashboard/front/main2.php can be used.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Glpi-Project | Dashboard | <= 1.0.2 |
Related Weaknesses (CWE)
References
- https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/dashboard-pluginThird Party Advisory
- https://plugins.glpi-project.org/#/plugin/dashboardVendor Advisory
- https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/dashboard-pluginThird Party Advisory
- https://plugins.glpi-project.org/#/plugin/dashboardVendor Advisory
FAQ
What is CVE-2021-30144?
CVE-2021-30144 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech...
How severe is CVE-2021-30144?
CVE-2021-30144 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-30144?
Check the references section above for vendor advisories and patch information. Affected products include: Glpi-Project Dashboard.