06. 12. 2023
Asset Management, Service Management
Type/Severity
Security Advisory: High
Topic
There is a security update for GLPI Agent
Description
This version specifically fixes 2 critical security issues related to MSI packaging on Windows:
- CVE-2024-28240: A local user could modify the GLPI Agent configuration to gain higher privileges.
- CVE-2024-28241: A local user could modify the GLPI Agent installation to gain higher privileges, but only when GLPI Agent is not installed in the default installation folder.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the links listed below in the References section.
Solution
These security issues only impact Windows installation performed with MSI packaging, so we urge you to upgrade all your agents as soon as possible if this is your case.
Affected Products
All GLPI Agent versions < 1.7.2
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://github.com/glpi-project/glpi-agent/releases/tag/1.7.3
- https://glpi-agent.readthedocs.io/en/latest/installation/
Author
Latest posts by Alessandro Mizzaro
23. 08. 2023
Development, Events, SEC4U
DEFCON 31: My Trip to Vegas w/ mhackeroni