CVE-2026-49469 - CVSS, EPSS & CISA Kev 상세 정보 | CVE Find

CVE 설명

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.

CVE 정보

관련 약점

CWE-ID	약점 이름	출처
CWE-90	Improper Neutralization of Special Elements used in an LDAP Query The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

참고 자료

https://github.com/glpi-project/glpi/commit/4fb3056bcd292b515acce96887f1376ce6d5aba8

https://github.com/glpi-project/glpi/commit/d413b48ea97b2f73ba30c90ae0d029aac860f71a

https://github.com/glpi-project/glpi/releases/tag/10.0.26

https://github.com/glpi-project/glpi/releases/tag/11.0.8

https://github.com/glpi-project/glpi/security/advisories/GHSA-3cgm-rj32-hfwf