Cyber Posture

CVE-2025-27147

High

Published: 25 March 2025

Published
25 March 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
EPSS Score 0.0008 24.5th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Security Summary

CVE-2025-27147 is an improper access control vulnerability (mapped to CWE-22, CWE-73, and CWE-552) in the GLPI Inventory Plugin for versions prior to 1.5.0. This plugin manages tasks for GLPI agents, such as network discovery and SNMP-based inventory, software deployment, VMware ESX host remote inventory, and data collection from files, the Windows registry, and WMI.

The vulnerability can be exploited over the network (AV:N) with low attack complexity (AC:L) by users possessing high privileges (PR:H), requiring no user interaction (UI:N). It results in high-scope impact (S:C), enabling attackers to achieve high confidentiality loss (C:H), such as unauthorized access to sensitive data, alongside low integrity (I:L) and availability (A:L) impacts. The CVSS v3.1 base score is 8.2.

Version 1.5.0 of the GLPI Inventory Plugin addresses the vulnerability. Additional mitigation guidance is available in the GitHub security advisory at GHSA-h6x9-jm98-cw7c and the fixing commit aaeb26d98d07019375c25b56e60fffc195553545.

Details

CWE(s)
CWE-22CWE-73CWE-552

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
Why these techniques?

The improper access control vulnerability (with path traversal elements per CWE-22/73/552) in a network-accessible GLPI plugin enables exploitation of a public-facing application (T1190) and directly facilitates unauthorized collection of sensitive data from the local system (T1005) as well as file and directory discovery (T1083) through the plugin's data collection features.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References