UpHeron
All vulnerabilities

Servers and applications

CVE-2024-43416

Users email enumeration by unauthenticated user

Severity
Medium 5.3
Published
18 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.0.17
Also known as
GHSA-j8gc-xpgr-2ww7
Sources
NVD, Project advisories (GitHub)

Description

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • From 0.80 before 10.0.17
GLPIServers and applications · github:glpi-project/glpi
  • From 0.80 before 10.0.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-43416
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-43416
  • GitHub Advisory Database https://github.com/advisories/GHSA-j8gc-xpgr-2ww7
  • github.com https://github.com/glpi-project/glpi/security/advisories/GHSA-j8gc-xpgr-2ww7