Read the docs
TI-2023-17089 Aliases CVE-2023-34254

Remote inventory task command injection when using ssh command mode

Priority LOW 37CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the agent is configured with for remoteinventory task. This vulnerability has been patched in glpi-agent 1.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00799 56th percentileScored 2026-11-07
Fix Fixed glpi-agent (glpi-project): 1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
glpi-projectglpi-agentbefore 1.51.5Patch availableCNA
  • glpi-agent Vendorglpi-project Affected before 1.5 Fixed in 1.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:glpi-project:glpi_agent:*:*:*:*:*:*:*:*before 1.5Vulnerableglpi-project
  • cpe:2.3:a:glpi-project:glpi_agent:*:*:*:*:*:*:*:* Versions before 1.5 Vulnerable ·glpi-project

Remediation

  • Fix · CNA glpi-agent (glpi-project) Fixed in 1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34254

References

Patch 1

Advisory 1

  • TI-2024-18800 GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder CVSS 3.1HIGH 7.8
  • TI-2024-18799 GLPI-Agent's MSI package installation permits local users to change Agent configuration CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences