CVE-2024-50339

9.3 criticalEPSS 19%

Critical (9.3) in glpi-project glpi. EPSS 19% chance of exploitation in the next 30 days.

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 19% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWEs: CWE-384, CWE-79, CWE-287
Published: 2024-12-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

glpi-project:glpi

References

https://github.com/glpi-project/glpi/releases/tag/10.0.17
https://github.com/glpi-project/glpi/security/advisories/GHSA-v977-g4r9-6r72

Check your stack JSON