Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-13240: GLPI lets password be changed again within 24 hours

CVE-2019-13240 · published 7 years ago

Summary

Versions of GLPI released before 9.4.1 allow a user’s password to be reset a second time within 24 hours after the first reset, without any notice except the email address. This can let an attacker hijack accounts by repeatedly changing passwords. Upgrade to GLPI 9.4.1 or later (or apply the available patch) to stop the extra reset and protect user accounts.

What to do

Update glpi-project glpi to version 9.4.1 or later.

Affected software

Vendor	Product	Affected versions
glpi-project	glpi	< 9.4.1 `cpe:2.3:a:glpi-project:glpi::::::::`

Original advisory text

An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information excep...

References

https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a3364... Patch Third Party Advisory
https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53d... Patch Third Party Advisory
https://github.com/glpi-project/glpi/compare/1783b78...8e621f6 Patch Third Party Advisory
https://github.com/glpi-project/glpi/releases/tag/9.4.1 Third Party Advisory
https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf Exploit Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.9 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-640Weak Password Recovery Mechanism for Forgotten Password

Timeline

Published10 Jul 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-13240 · NVD

Track software like this

Free during beta