CVE-2019-13240
N/A
Published: July 10, 2019 at 01:48 PM UTC
Updated: June 17, 2026 at 02:16 AM UTC
1 product affected across 1 vendorGlpi
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 2%
Description
An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 9.4.1
Affected range stops below 9.4.1, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (5)
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/glpi-project/glpi/compare/1783b78...8e621f6x_refsource_MISCThird Party Advisory
Source: [email protected]
https://github.com/glpi-project/glpi/releases/tag/9.4.1x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdfQuick Info
StatusMODIFIED
CWE
CWE-640
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card