VDB
CVE-2019-14666
CVE-2019-14666
PUBLISHED
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.
EPSS 3.01% · 86.9th percentile
Risk Scores
EPSS Score
3.01%
86.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | glpi | 0.84.8+dfsg.1-1, *, 0 |
Exploit Intelligence
Timeline
- Sep 25, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-14666 third-party-advisory
- https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-14666 third-party-advisory