Detections
Analytics

FreeBSD : glpi-project -- GLPI multiple vulnerabilities (c36decbe-3c84-11f0-8d29-b42e991fc52e)

high Nessus Plugin ID 237566

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c36decbe-3c84-11f0-8d29-b42e991fc52e advisory.

 [email protected] reports:

 CVE-2024-11955: A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php.
 The manipulation of the argument redirect leads to open redirect. The attack can be launched remotely.
 The exploit has been disclosed to the public and may be used. Upgrading to version 10.0.18 is able to address this issue.
 It is recommended to upgrade the affected component.


 CVE-2025-23024: Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch.
 As a workaround, one may delete the `install/update.php` file.


 CVE-2025-23046: Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information.
 Version 10.0.18 contains a patch.
 As a workaround, one may delete the `install/update.php` file.


 CVE-2025-25192: Starting in version 9.5.0 and prior to version 10.0.18, if a Mail servers authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established.
 Version 10.0.18 contains a patch. As a workaround, one may disable any Mail servers authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.


 CVE-2025-21626: Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint.
 Version 10.0.18 contains a fix for the issue.
 Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers.


 CVE-2025-21627: In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.


 CVE-2025-21619: An administrator user can perfom a SQL injection through the rules configuration forms.
 This vulnerability is fixed in 10.0.18.


 CVE-2025-24799: An unauthenticated user can perform a SQL injection through the inventory endpoint.
 This vulnerability is fixed in 10.0.18.


 CVE-2025-24801: An authenticated user can upload and force the execution of *.php files located on the GLPI server.
 This vulnerability is fixed in 10.0.18.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://nvd.nist.gov/vuln/detail/CVE-2024-11955

https://nvd.nist.gov/vuln/detail/CVE-2025-21619

https://nvd.nist.gov/vuln/detail/CVE-2025-21626

https://nvd.nist.gov/vuln/detail/CVE-2025-21627

https://nvd.nist.gov/vuln/detail/CVE-2025-23024

https://nvd.nist.gov/vuln/detail/CVE-2025-23046

https://nvd.nist.gov/vuln/detail/CVE-2025-24799

https://nvd.nist.gov/vuln/detail/CVE-2025-24801

https://nvd.nist.gov/vuln/detail/CVE-2025-25192

http://www.nessus.org/u?38859c80

Plugin Details

Severity: High

ID: 237566

File Name: freebsd_pkg_c36decbe3c8411f08d29b42e991fc52e.nasl

Version: 1.1

Type: local

Published: 5/30/2025

Updated: 5/30/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2024-11955

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2025-23046

CVSS v4

Risk Factor: High

Base Score: 8.2

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS Score Source: CVE-2025-21619

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:glpi, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/29/2025

Vulnerability Publication Date: 2/25/2025

Reference Information

CVE: CVE-2024-11955, CVE-2025-21619, CVE-2025-21626, CVE-2025-21627, CVE-2025-23024, CVE-2025-23046, CVE-2025-24799, CVE-2025-24801, CVE-2025-25192