CVE-2024-47761

What it actually does

An administrator with access to sent notification contents can extract account takeover tokens or credentials that permit elevation to a higher-privileged account.

Why it matters to the business

Compromise of the central IT asset management platform can expose inventory, tickets, user accounts, and configuration data across the organization; the low EPSS and absence from KEV indicate limited observed exploitation but the flaw remains reachable by any authenticated admin.

How an attack unfolds

An attacker who already holds an administrator role inspects the contents of previously sent notifications, locates embedded tokens or reset links intended for higher-privileged users, and uses that material to assume control of those accounts.

How to fix it

Upgrade glpi-project/glpi to version 10.0.17 or apply commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9; the Red Hat OpenShift package jenkins-2-plugins must be updated to 0:4.7.1652967082-1.el8.

How to confirm the fix worked

Confirm the running GLPI version is at least 10.0.17, review the changelog for the referenced commit, and verify that notification templates no longer embed recoverable account tokens.

Typical attack path

1. Obtain administrator credentials in GLPI
2. Navigate to the notification log or sent-mail archive
3. Locate a notification containing an account-recovery token or credential for a higher-privileged user
4. Replay or redeem the token to assume the higher-privileged identity

How to detect it

Review GLPI application logs and web-server access logs for unusual queries against the notification archive or repeated use of password-reset tokens shortly after an administrator session; correlate with successful logins from the same session to a higher-privileged account.

What your security team should do

• Immediately schedule upgrade to the fixed release for all GLPI instances
• Restrict access to the notification archive to the minimum necessary personnel
• Audit existing administrator accounts for unexpected privilege changes
• Monitor EPSS trend and threat-intel feeds for any future increase in exploitation