CVE-2021-43779 | GLPI is an open source IT Asset Management, issue tracking s… | CVSS 9.9 CRITICAL

Description

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.

Metadata

CVE ID: CVE-2021-43779
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2021-11-16 00:00 UTC
Published: 2022-01-05 18:45 UTC
Last updated: 2025-09-08 15:33 UTC
Primary CWE: CWE-20
CWE-20: Improper Input Validation
Vendor / Product: pluginsGLPI / addressing
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
pluginsGLPI	addressing	—	< 2.9.1

Weakness (CWE)

CWE	Source	Description
CWE-20	cna	CWE-20: Improper Input Validation

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

References (3)