GLPI Exposure of Sensitive Information Vulnerability in status.php Endpoint

A vulnerability allowing the exposure of sensitive information has been identified in GLPI versions 0.71 and prior to 10.0.18. An anonymous user can access this information through the status.php endpoint. The vulnerability arises from inadequate access controls, allowing unauthorized users to retrieve sensitive data.

Impact

Exploitation of this vulnerability allows for the unauthorized retrieval of sensitive information from the status.php endpoint.

Remediation

Users are advised to upgrade to GLPI version 10.0.18, which addresses this vulnerability. Alternatively, the status.php file can be deleted, access to it can be restricted, or sensitive values can be removed from the name field of active LDAP directories, mail server authentication providers, and mail receivers.