CVEvulnerability
CVE-2021-43779
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-01-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-20, CWE-78
Description
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
Affected configurations
• teclib-edition addressing (< 2.9.1)
Related
References
- https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin Exploit, Third Party Advisory
- https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366 Patch, Third Party Advisory
- https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh Exploit, Third Party Advisory
- https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779 github.com
- https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin Exploit, Third Party Advisory
- https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366 Patch, Third Party Advisory
- https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh Exploit, Third Party Advisory