22. 03. 2025
Asset Management, NetEye
Type/Severity
Security Advisory: High
Topic
There is a security update for GLPI Agent
Description
This version specifically fixes 2 critical security issues related to MSI packaging on Windows:
- CVE-2024-28240: A local user could modify the GLPI Agent configuration to gain higher privileges.
- CVE-2024-28241: A local user could modify the GLPI Agent installation to gain higher privileges, but only when GLPI Agent is not installed in the default installation folder.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the links listed below in the References section.
Solution
These security issues only impact Windows installation performed with MSI packaging, so we urge you to upgrade all your agents as soon as possible if this is your case.
Affected Products
All GLPI Agent versions < 1.7.2
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://github.com/glpi-project/glpi-agent/releases/tag/1.7.3
- https://glpi-agent.readthedocs.io/en/latest/installation/
Alessandro Mizzaro
Security Software Engineer at Wuerth Phoenix
Author
