Volerion logoVolerion
Volerion logoVolerion

GLPI Blind Server-Side Request Forgery Vulnerability in RSS Feeds and External Calendars

Vulnerability

A blind server-side request forgery (SSRF) vulnerability has been identified in GLPI versions 0.84 through 10.0.18. This issue arises when using RSS feeds or external calendars in the planning feature, allowing for potential exploitation. Previous security patches applied since GLPI 10.0.4 were insufficient to address certain specific scenarios, leaving this vulnerability open.

Impact

Exploitation of this vulnerability allows for blind server-side request forgery, where an attacker can manipulate the server to make requests on its behalf, potentially leading to unauthorized data access or interaction with internal services.

Remediation

Users are advised to upgrade to GLPI version 10.0.19, where this vulnerability has been patched.

Added: Jul 30, 2025, 2:32 PM
Updated: Jul 30, 2025, 2:32 PM

Vulnerability Rating

Custom Algorithm
spread
5.0
impact
0.6
exploitability
5.2
remediation
7.7
relevance
0.3
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.