GLPI: MFA bypass

Summary

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

Remediation

1. Inventory every glpi-project glpi deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch
• Referencehttps://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd
• Referencehttps://github.com/glpi-project/glpi/releases/tag/11.0.8