Security readout for executives and security teams
Plain-English summary
GLPI 9.3.1 allowed reminder descriptions to contain embedded frame or form content. A privileged user could use that field to present deceptive forms to GLPI users and capture submitted information outside the organization. The CVE lists GLPI 9.4.1 as the fixed version.
Executive priority
Treat this as a targeted phishing risk inside GLPI rather than a broad remote takeover issue. Prioritize upgrade and admin-rights review if GLPI 9.3.1 is present, especially in environments with many helpdesk or asset-management users.
Technical view
The issue is frame and form tag injection in Tools > Reminder > Description in GLPI 9.3.1. The reported impact is phishing of users or groups by an admin-controlled reminder description. The source bundle does not provide CVSS, CWE, or detailed patch mechanics.
Likely exposure
Exposure is most likely where GLPI 9.3.1 is still deployed and reminder descriptions are viewable by users or groups. Risk is higher if broad admin rights are granted to people who are not fully trusted.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation evidence. The described abuse requires an admin-level actor placing deceptive frame or form content in a reminder description, followed by user interaction.
Researcher notes
Evidence is limited to the CVE description and linked GLPI release and pull request references. The bundle identifies the affected field and fixed version, but does not provide CVSS, CWE, proof of exploitation, or detailed vendor mitigation beyond upgrading.
Mitigation direction
- Upgrade GLPI 9.3.1 systems to GLPI 9.4.1 or later.
- Check GLPI vendor release and pull request guidance before remediation.
- Review reminder descriptions for unexpected embedded frame or form content.
- Limit GLPI admin privileges to trusted, accountable users only.
- Remove suspicious reminder content and reset credentials if phishing is suspected.
Validation and detection
- Inventory GLPI instances and confirm whether version 9.3.1 is running.
- Verify production GLPI is updated to 9.4.1 or later.
- Review Tools > Reminder descriptions for embedded frames or forms.
- Audit users with admin rights and reminder-management privileges.
- Check security logs for suspicious credential submissions or related phishing reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-1010310 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/glpi-project/glpi/releases/tag/9.3.1CVE reference · x_refsource_MISC
- https://github.com/glpi-project/glpi/pull/5519CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.