SCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Priority LOW 31CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-862.
Summary
The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly accessible in read-only mode. This issue is patched in version 2.3.0. No known workarounds exist.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Fix Fixed sccm (pluginsGLPI): 2.3.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pluginsGLPI | sccm | before 2.3.0 | 2.3.0 | Patch available | CNA |
- sccm VendorpluginsGLPI Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:teclib-edition:system_center_configuration_manager:*:*:*:*:*:gpli:*:* | before 2.3.0 | Vulnerable | Teclib-edition |
- cpe:2.3:a:teclib-edition:system_center_configuration_manager:*:*:*:*:*:gpli:*:* Versions before 2.3.0 Vulnerable ·Teclib-edition
Remediation
- Fix · CNA sccm (pluginsGLPI) Fixed in 2.3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-39190
References
More pluginsGLPI vulnerabilities
- TI-2024-36046 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation CVSS 3.1HIGH 8.2
- TI-2026-38943 Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering CVSS 4.0HIGH 7.3
- TI-2025-20010 Escalade GLPI Plugin Vulnerable to Improper Access Control CVSS 3.1MEDIUM 6.5
- TI-2026-09772 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import CVSS 4.0HIGH 7.1
- TI-2024-30621 Fields GLPI plugin has an Authenticated SQL Injection CVSS 3.1HIGH 7.7
- TI-2025-40221 GLPI Database Inventory Plugin Vulnerable to Stored Object Injection CVSS 3.1MEDIUM 6.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences