CVE-2024-28240

The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit GLPI-Agent related key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and add `SystemComponent` DWORD value setting it to `1` to hide GLPI-Agent from installed applications.

• CWE-20

• https://github.com/glpi-project/glpi-agent/commit/41bbb1169e899bd15350a9e2fdbf9269a3b7a14fPatch
• https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-hx3x-mmqg-h3jpVendor Advisory
• https://github.com/glpi-project/glpi-agent/commit/41bbb1169e899bd15350a9e2fdbf9269a3b7a14fPatch
• https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-hx3x-mmqg-h3jpVendor Advisory

Published

Apr 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28235Contao is an open source content management system. Starting…6.5
• CVE-2024-28236Vela is a Pipeline Automation (CI/CD) framework built on Lin…6.5
• CVE-2024-28237OctoPrint provides a web interface for controlling consumer …4.8
• CVE-2024-28238Directus is a real-time API and App dashboard for managing S…2.3
• CVE-2024-28239Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2024-2824A vulnerability was found in Matthias-Wandel jhead 3.08 and …6.3
• CVE-2024-28241The GLPI Agent is a generic management agent. Prior to versi…7.8
• CVE-2024-28242Discourse is an open source platform for community discussio…7.5
• CVE-2024-28243KaTeX is a JavaScript library for TeX math rendering on the …6.5
• CVE-2024-28244KaTeX is a JavaScript library for TeX math rendering on the …6.5
• CVE-2024-28245KaTeX is a JavaScript library for TeX math rendering on the …6.1
• CVE-2024-28246KaTeX is a JavaScript library for TeX math rendering on the …5.4