LDAP password exposure in glpi

published 2022-04-21 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-29643

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.

Patch / fix

fixed in 1 links 1

glpi-project glpi 10.0.0

github.com/glpi-project/glpi@26f0a20 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-24867 updated 2025-11-21

glpi: allow for a cross site scripting attack vector

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago (2025-04-23)

Exploit prediction

1.31% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	7.8	AV:N/AC:L/Au:N/C:C/I:N/A:N

Affected products

glpi-project glpi

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 Insufficiently Protected Credentials

References

github.com /glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e
patch, third-party-advisory
github.com /glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr
third-party-advisory

Sources

CVE List CVE-2022-24867
NVD CVE-2022-24867

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary