Search
Find a vulnerability
Search criteria
2 vulnerabilities found for addressing by teclib-edition
CVE-2021-43779 (GCVE-0-2021-43779)
Vulnerability from nvd – Published: 2022-01-05 18:45 – Updated: 2025-09-08 15:33
VLAI
Title
Remote Command Execution vulnerability
Summary
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pluginsGLPI/addressing/securit… | x_refsource_CONFIRM |
| https://github.com/pluginsGLPI/addressing/commit/… | x_refsource_MISC |
| https://github.com/hansmach1ne/MyExploits/tree/ma… | x_refsource_MISC |
| https://github.com/hansmach1ne/CVE-portfolio/tree… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pluginsGLPI | addressing |
Affected:
< 2.9.1
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-09-08T15:33:16.901Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-43779",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:42:30.567643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T18:34:23.930Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "addressing",
"vendor": "pluginsGLPI",
"versions": [
{
"status": "affected",
"version": "\u003c 2.9.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions \u003c 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server\u0027s underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-16T18:00:25.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin"
}
],
"source": {
"advisory": "GHSA-q5fp-xpr8-77jh",
"discovery": "UNKNOWN"
},
"title": "Remote Command Execution vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-43779",
"STATE": "PUBLIC",
"TITLE": "Remote Command Execution vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "addressing",
"version": {
"version_data": [
{
"version_value": "\u003c 2.9.1"
}
]
}
}
]
},
"vendor_name": "pluginsGLPI"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions \u003c 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server\u0027s underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20: Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh",
"refsource": "CONFIRM",
"url": "https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh"
},
{
"name": "https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366",
"refsource": "MISC",
"url": "https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366"
},
{
"name": "https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin",
"refsource": "MISC",
"url": "https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin"
}
]
},
"source": {
"advisory": "GHSA-q5fp-xpr8-77jh",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-43779",
"datePublished": "2022-01-05T18:45:11.000Z",
"dateReserved": "2021-11-16T00:00:00.000Z",
"dateUpdated": "2025-09-08T15:33:16.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43779 (GCVE-0-2021-43779)
Vulnerability from cvelistv5 – Published: 2022-01-05 18:45 – Updated: 2025-09-08 15:33
VLAI
Title
Remote Command Execution vulnerability
Summary
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pluginsGLPI/addressing/securit… | x_refsource_CONFIRM |
| https://github.com/pluginsGLPI/addressing/commit/… | x_refsource_MISC |
| https://github.com/hansmach1ne/MyExploits/tree/ma… | x_refsource_MISC |
| https://github.com/hansmach1ne/CVE-portfolio/tree… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pluginsGLPI | addressing |
Affected:
< 2.9.1
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-09-08T15:33:16.901Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43779"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-43779",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:42:30.567643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T18:34:23.930Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "addressing",
"vendor": "pluginsGLPI",
"versions": [
{
"status": "affected",
"version": "\u003c 2.9.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions \u003c 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server\u0027s underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-16T18:00:25.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin"
}
],
"source": {
"advisory": "GHSA-q5fp-xpr8-77jh",
"discovery": "UNKNOWN"
},
"title": "Remote Command Execution vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-43779",
"STATE": "PUBLIC",
"TITLE": "Remote Command Execution vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "addressing",
"version": {
"version_data": [
{
"version_value": "\u003c 2.9.1"
}
]
}
}
]
},
"vendor_name": "pluginsGLPI"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions \u003c 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server\u0027s underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20: Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh",
"refsource": "CONFIRM",
"url": "https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-q5fp-xpr8-77jh"
},
{
"name": "https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366",
"refsource": "MISC",
"url": "https://github.com/pluginsGLPI/addressing/commit/6f55964803054a5acb5feda92c7c7f1d91ab5366"
},
{
"name": "https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin",
"refsource": "MISC",
"url": "https://github.com/hansmach1ne/MyExploits/tree/main/RCE_GLPI_addressing_plugin"
}
]
},
"source": {
"advisory": "GHSA-q5fp-xpr8-77jh",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-43779",
"datePublished": "2022-01-05T18:45:11.000Z",
"dateReserved": "2021-11-16T00:00:00.000Z",
"dateUpdated": "2025-09-08T15:33:16.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}