CVE-2021-43779

moderate-risk
Published 2022-01-05

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.

Do I need to act?

~
3.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: f44a77e45ca4e6b164083774a757bdc7a0d9d93b, 6f55964803054a5acb5feda92c7c7f1d91ab5366
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Addressing

Affected Vendors

Teclib-Edition

References (7)

Exploit https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin
Patch https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1...
Exploit https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77j...
https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779
Exploit https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin
Patch https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1...
Exploit https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77j...
45
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 7/34 · Low
Exposure 5/34 · Minimal