The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bb49f1fa-00da-11ef-92b7-589cfc023192 advisory.

  - GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk,     licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability     in the search engine to extract data from the database. This issue has been patched in version 10.0.13.
    (CVE-2024-27096)

  - GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk,     licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using     Arbitrary Object Instantiation. This issue has been patched in version 10.0.13. (CVE-2024-27098)

  - GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk,     licenses tracking and software auditing. A user with rights to create and share dashboards can build a     dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS     attack. This issue has been patched in version 10.0.13. (CVE-2024-27104)

  - GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk,     licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI     administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the     administrator navigates through the debug bar. This issue has been patched in version 10.0.13.
    (CVE-2024-27914)

  - GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk,     licenses tracking and software auditing. An authenticated user can access sensitive fields data from items     on which he has read access. This issue has been patched in version 10.0.13. (CVE-2024-27930)

  - GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk,     licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI     users. This issue has been patched in version 10.0.13. (CVE-2024-27937)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

FreeBSD : GLPI -- multiple vulnerabilities (bb49f1fa-00da-11ef-92b7-589cfc023192)

high Nessus Plugin ID 193816

Version 1.0