Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2019-10233: GLPI can leak login cookie information through timing
CVE-2019-10233 · published 7 years ago
Summary
The GLPI system (versions before 9.4.1.1) can reveal details about a user's login cookie by measuring how long the server responds. An attacker could use this information to impersonate users or access the system. Update GLPI to version 9.4.1.1 or later to stop the timing leakage.
What to do
- Update glpi-project glpi to version 9.4.1.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| glpi-project | glpi |
< 9.4.1.1 cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* |
Original advisory text
Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
References
- https://github.com/glpi-project/glpi/pull/5562 Patch Third Party Advisory
- https://github.com/glpi-project/glpi/releases/tag/9.4.1.1 Release Notes Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-203Observable Discrepancy
Timeline
Published27 Mar 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-10233 · NVD
Track software like this
Free during beta