← All advisories

Medium severity6.5NVD Advisory· Published Feb 1, 2024· Updated Jun 17, 2026

CVE-2024-23645

CVE-2024-23645

Description

GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Glpi Project/Glpi3 versions
cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*range: >=0.65,<10.0.12
- (no CPE)range: >=10.0.12
- (no CPE)range: >= 0.65, < 10.0.12

Patches

Vulnerability mechanics

References

4

github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0nvdPatch
github.com/glpi-project/glpi/commit/fc1f6da9d158933b870ff374ed3a50ae98dcef4anvdPatch
github.com/glpi-project/glpi/releases/tag/10.0.12nvdPatchRelease Notes
github.com/glpi-project/glpi/security/advisories/GHSA-2gj5-qpff-ff3xnvdVendor Advisory

News mentions

0

No linked articles in our index yet.