CVE-2025-21626
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-21626
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21626.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-21626
- Aliases
-
- GHSA-5vvr-pxwf-3w77
- Related
- Published
- 2025-02-25T16:15:37Z
- Modified
- 2025-03-05T03:57:41.314880Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the
status.phpendpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete thestatus.phpfile, restrict its access, or remove any sensitive values from thenamefield of the active LDAP directories, mail servers authentication providers and mail receivers. - References