vulnerability

Ubuntu: (CVE-2019-14666): glpi vulnerability

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:S/C:P/I:P/A:P)

Published

Sep 25, 2019

Added

Jun 26, 2025

Modified

Jun 26, 2025

Description

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.

Solution

no-fix-ubuntu-package

References

CVE-2019-14666
https://attackerkb.com/topics/CVE-2019-14666
https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q
https://www.cve.org/CVERecord?id=CVE-2019-14666

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report