GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.
References
| Link | Resource |
|---|---|
| https://github.com/glpi-project/glpi/releases/tag/10.0.18 | Release Notes |
| https://github.com/glpi-project/glpi/security/advisories/GHSA-vfxc-qg3v-j2r5 | Third Party Advisory |
Configurations
History
28 Feb 2025, 13:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* | |
| References | () https://github.com/glpi-project/glpi/releases/tag/10.0.18 - Release Notes | |
| References | () https://github.com/glpi-project/glpi/security/advisories/GHSA-vfxc-qg3v-j2r5 - Third Party Advisory | |
| First Time |
Glpi-project
Glpi-project glpi |
25 Feb 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-25 18:15
Updated : 2025-02-28 13:35
NVD link : CVE-2025-23046
Mitre link : CVE-2025-23046
JSON object : View
Products Affected
glpi-project
- glpi
CWE
CWE-303
Incorrect Implementation of Authentication Algorithm