Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2019-13240 Details

Description

An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.9 MEDIUMVector:CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7 CVEPatchThird Party Advisory
https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6 CVEPatchThird Party Advisory
https://github.com/glpi-project/glpi/compare/1783b78...8e621f6 CVEPatchThird Party Advisory
https://github.com/glpi-project/glpi/releases/tag/9.4.1 CVEThird Party Advisory
https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf CVEExploitThird Party Advisory

see all 10 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-640Weak Password Recovery Mechanism for Forgotten Password[email protected]

Affected Products

ProductVersions
glpi-project glpi
< 9.4.1

CPE

  • cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

4 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2019-13240
NVD Published Date:
Jul 10, 2019
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2019-13240 Details - Not Deferred