Security readout for executives and security teams
Plain-English summary
GLPI versions before 9.1.5 contain a SQL injection flaw in a dropdown-related AJAX request. In business terms, an exposed vulnerable GLPI instance could allow database manipulation or data access depending on deployment and privileges. The provided sources do not include severity scoring or confirmed exploitation.
Executive priority
Treat this as a patch verification item for any GLPI deployment. The vulnerability class is important, but the provided evidence lacks severity scoring and exploitation confirmation, so priority should be driven by GLPI exposure and business data sensitivity.
Technical view
CVE-2017-11329 affects GLPI before 9.1.5. The flaw is tied to ajax/getDropdownValue.php handling of the entity_restrict parameter when it is not constrained to a list of integers. The bundle does not provide CVSS, CWE, authentication requirements, or exploit confirmation.
Likely exposure
Organizations running GLPI versions earlier than 9.1.5 are potentially exposed, especially if the GLPI web interface is reachable by untrusted users. The source bundle does not identify specific editions, configurations, or hosting models beyond GLPI before 9.1.5.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source confirms active exploitation. The issue requires access to the vulnerable GLPI endpoint and malformed input to the affected parameter; further exploitability details are not provided.
Researcher notes
The public bundle is sparse: no CVSS vector, CWE mapping, authentication detail, or exploit status is provided. The strongest facts are the vulnerable version boundary, endpoint, parameter, and vendor-linked GitHub issue and 9.1.5 release reference.
Mitigation direction
- Upgrade GLPI to 9.1.5 or a later supported version.
- Review GLPI 9.1.5 vendor release notes before rollout.
- Limit untrusted network access to GLPI until upgraded.
- Check vendor guidance for any additional supported mitigations.
Validation and detection
- Inventory all GLPI instances and record their versions.
- Confirm no production instance is earlier than 9.1.5.
- Review web logs for unusual access to ajax/getDropdownValue.php.
- Verify the upgrade in staging before production deployment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-11329 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/glpi-project/glpi/issues/2456CVE reference · x_refsource_CONFIRM
- https://github.com/glpi-project/glpi/releases/tag/9.1.5CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.