CVE-2023-28634

GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

• CWE-285
• CWE-863

• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch, Release Notes
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch, Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-4279-rxmh-gf39Vendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.7Patch, Release Notes
• https://github.com/glpi-project/glpi/releases/tag/9.5.13Patch, Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-4279-rxmh-gf39Vendor Advisory

Published

Apr 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28629GoCD is an open source continuous delivery server. GoCD vers…5.4
• CVE-2023-2863A vulnerability has been found in Simple Design Daily Journa…5.5
• CVE-2023-28630GoCD is an open source continuous delivery server. In GoCD v…4.4
• CVE-2023-28631comrak is a CommonMark + GFM compatible Markdown parser and …9.8
• CVE-2023-28632GLPI is a free asset and IT management software package. Sta…8.1
• CVE-2023-28633GLPI is a free asset and IT management software package. Sta…5.4
• CVE-2023-28635vantage6 is privacy preserving federated learning infrastruc…5.4
• CVE-2023-28636GLPI is a free asset and IT management software package. Sta…4.8
• CVE-2023-28637DataEase is an open source data visualization analysis tool.…8.8
• CVE-2023-28638Snappier is a high performance C# implementation of the Snap…5.9
• CVE-2023-28639GLPI is a free asset and IT management software package. Sta…6.1
• CVE-2023-2864A vulnerability was found in SourceCodester Online Jewelry S…6.1