Unrated severityNVD Advisory· Published Sep 25, 2019· Updated Aug 5, 2024
CVE-2019-14666
CVE-2019-14666
Description
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- GLPI/GLPIdescription
- Range: <= 9.4.3
Patches
Vulnerability mechanics
References
2- github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5qmitrex_refsource_CONFIRM
- www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txtmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.