CVE-2021-21324

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference (IDOR) on "Solutions". This vulnerability gives an unauthorized user the ability to enumerate GLPI items names (including users logins) using the knowbase search form (requires authentication). To Reproduce: Perform a valid authentication at your GLPI instance, Browse the ticket list and select any open ticket, click on Solution form, then Search a solution form that will redirect you to the endpoint /"glpi/front/knowbaseitem.php?item_itemtype=Ticket&item_items_id=18&forcetab=Knowbase$1", and the item_itemtype=Ticket parameter present in the previous URL will point to the PHP alias of glpi_tickets table, so just replace it with "Users" to point to glpi_users table instead; in the same way, item_items_id=18 will point to the related column id, so changing it too you should be able to enumerate all the content which has an alias. Since such id(s) are obviously incremental, a malicious party could exploit the vulnerability simply by guessing-based attempts.

• CWE-639

• https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dcPatch, Third Party Advisory
• https://github.com/glpi-project/glpi/releases/tag/9.5.4Release Notes, Third Party Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-jvwm-gq36-3v7vExploit, Third Party Advisory
• https://github.com/glpi-project/glpi/commit/aade65b7f67d46f23d276a8acb0df70651c3b1dcPatch, Third Party Advisory
• https://github.com/glpi-project/glpi/releases/tag/9.5.4Release Notes, Third Party Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-jvwm-gq36-3v7vExploit, Third Party Advisory

Published

Mar 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21318Opencast is a free, open-source platform to support the mana…5.4
• CVE-2021-21319Galette is a membership management web application geared to…5.4
• CVE-2021-21320matrix-react-sdk is an npm package which is a Matrix SDK for…4.3
• CVE-2021-21321fastify-reply-from is an npm package which is a fastify plug…10
• CVE-2021-21322fastify-http-proxy is an npm package which is a fastify plug…9.8
• CVE-2021-21323Brave is an open source web browser with a focus on privacy …5.3
• CVE-2021-21325GLPI is an open-source asset and IT management software pack…4.8
• CVE-2021-21326GLPI is an open-source asset and IT management software pack…6.5
• CVE-2021-21327GLPI is an open-source asset and IT management software pack…7.5
• CVE-2021-21328Vapor is a web framework for Swift. In Vapor before version …5.3
• CVE-2021-21329RATCF is an open-source framework for hosting Cyber-Security…9.8
• CVE-2021-21330aiohttp is an asynchronous HTTP client/server framework for …6.1