Read the docs
TI-2024-18799 Aliases CVE-2024-28240

GLPI-Agent's MSI package installation permits local users to change Agent configuration

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit GLPI-Agent related key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and add `SystemComponent` DWORD value setting it to `1` to hide GLPI-Agent from installed applications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00224 13th percentileScored 2026-11-07
Fix Fixed glpi-agent (glpi-project): 1.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
glpi-projectglpi-agentbefore 1.7.21.7.2Patch availableCNA
  • glpi-agent Vendorglpi-project Affected before 1.7.2 Fixed in 1.7.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:glpi-project:glpi_agent:*:*:*:*:*:*:*:*before 1.7.2Vulnerableglpi-project
  • cpe:2.3:a:glpi-project:glpi_agent:*:*:*:*:*:*:*:* Versions before 1.7.2 Vulnerable ·glpi-project

Remediation

  • Fix · CNA glpi-agent (glpi-project) Fixed in 1.7.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28240

References

Patch 1

Advisory 1

  • TI-2023-17089 Remote inventory task command injection when using ssh command mode CVSS 3.1HIGH 7.7
  • TI-2024-18800 GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences