Critical severity · published Jan 5, 2022
CVE-2021-43779
GLPI is an open source IT Asset Management, issue tracking system and service desk system
9.9
CVSS
9.1%
EPSS
No
On KEV
Description
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)9.1% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Addressing · Teclib-edition
before 2.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43779
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43779
Exploit
https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin
Patch
https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366
Exploit
https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh
github.com
https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779