CVE-2023-35924

Summary

CVE-2023-35924 is a vulnerability affecting GLPI, a free asset and IT management software. Starting from version 10.0.0 and before 10.0.8, the GLPI inventory endpoint is susceptible to SQL injection attacks due to insufficient input validation. This issue can be exploited without requiring authentication. GLPI has released a patch for this vulnerability in version 10.0.8. As a temporary measure, disabling the native inventory feature is suggested to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.