GLPI permite a execução de regras em ordem não autorizada

The primary impact of CVE-2025-53105 is the potential for unauthorized modification of GLPI’s rule execution order. Attackers could leverage this to bypass security controls, escalate privileges, or manipulate data within the IT asset management system. For example, an attacker could alter rules related to user access or asset assignment, granting themselves or other malicious actors elevated permissions. The blast radius extends to any data or functionality controlled by GLPI’s rules engine, potentially impacting the entire IT infrastructure managed by the system. While not directly exploitable for remote code execution, the ability to manipulate rules can lead to significant operational disruption and data breaches.

Organizations heavily reliant on GLPI for IT asset management and service desk functionality are at significant risk. Specifically, deployments with a large number of users who do not have administrative privileges are particularly vulnerable, as these users represent the potential attack vector. Shared hosting environments where multiple users share a single GLPI instance also face increased risk.

• wordpress / composer / npm:

grep -r 'rule_execution_order' /var/www/html/glpi/

• generic web:

curl -I http://your-glpi-server/index.php?app=rules&module=rule_execution_order

1. 2025-08-27Disclosure

   disclosure

1. Reservado2025-06-25
2. Publicada2025-08-27
3. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-53105 is to immediately upgrade GLPI to version 10.0.19 or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. While no direct WAF rules can prevent this vulnerability, restricting user permissions and carefully auditing rule changes can help limit the potential impact. Regularly review and validate all GLPI rules to ensure they adhere to security best practices. After upgrading, confirm the fix by verifying that non-administrator users are unable to modify the rule execution order within the GLPI interface.