CVE-2024-28240
CVSS V2 None
CVSS V3 None
Description
The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit GLPI-Agent related key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and add `SystemComponent` DWORD value setting it to `1` to hide GLPI-Agent from installed applications.
Overview
- CVE ID
- CVE-2024-28240
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-04-25T16:37:32.215Z
- Last Modified Date
- 2024-06-04T18:03:27.642Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-hx3x-mmqg-h3jp | x_refsource_CONFIRM |
| https://github.com/glpi-project/glpi-agent/commit/41bbb1169e899bd15350a9e2fdbf9269a3b7a14f | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-28240 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28240 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-26 07:55:00 | Added to TrackCVE |