CVE-2019-13240

An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.

• CWE-640

• https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7Patch, Third Party Advisory
• https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6Patch, Third Party Advisory
• https://github.com/glpi-project/glpi/compare/1783b78...8e621f6Patch, Third Party Advisory
• https://github.com/glpi-project/glpi/releases/tag/9.4.1Third Party Advisory
• https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdfExploit, Third Party Advisory
• https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7Patch, Third Party Advisory
• https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6Patch, Third Party Advisory
• https://github.com/glpi-project/glpi/compare/1783b78...8e621f6Patch, Third Party Advisory
• https://github.com/glpi-project/glpi/releases/tag/9.4.1Third Party Advisory
• https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdfExploit, Third Party Advisory

Published

Jul 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13235In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, th…
• CVE-2019-13236In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, t…
• CVE-2019-13237In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple res…4.3
• CVE-2019-13238An issue was discovered in Bento4 1.5.1.0. A memory allocati…
• CVE-2019-13239inc/user.class.php in GLPI before 9.4.3 allows XSS via a use…
• CVE-2019-1324An information disclosure vulnerability exists when the Wind…5.3
• CVE-2019-13241FlightCrew v0.9.2 and older are vulnerable to a directory tr…7.8
• CVE-2019-13242IrfanView 4.52 has a User Mode Write AV starting at image004…
• CVE-2019-13243IrfanView 4.52 has a User Mode Write AV starting at image004…
• CVE-2019-13244FastStone Image Viewer 7.0 has a User Mode Write AV starting…
• CVE-2019-13245FastStone Image Viewer 7.0 has a User Mode Write AV starting…
• CVE-2019-13246FastStone Image Viewer 7.0 has a User Mode Write AV starting…