CVE-2023-51446 is an LDAP injection in GLPI, the IT asset and service management software, rated Medium (5.9). When authentication is made against LDAP, the login form can be used to perform the injection. Upgrade to GLPI 10.0.12 or later.
What's affected
The GitHub advisory GHSA-p995-jmfv-c7r8 lists the affected package as glpi in versions 0.70 and later, with 10.0.12 as the patched version. It was published on 1 February 2024 and labeled Moderate, 5.9. The record agrees on the score and the fix: CVSS 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Only installations that authenticate users against an LDAP directory are described as affected. Installations that use only local accounts do not use the LDAP login path, though upgrading is still sensible. The record's CISA KEV flag is false. The advisory credits the reporter by handle and says nothing about exploitation.
How to check if you're exposed
Read your GLPI version from the login page footer or from the Setup, General screen after signing in. From the server, check the version file in the install directory:
grep -r "GLPI_VERSION" /var/www/html/glpi/inc/define.php
The path will differ in your deployment. Next, confirm whether LDAP authentication is configured. In the GLPI interface this is under Setup, Authentication, LDAP directories. If a directory is listed and enabled for login, the affected code path is in use.
If you run GLPI in containers, check the image tag. The Gold directory and scanner at gold.safeguard.sh/scan can also help you track which applications in your estate rely on GLPI.
What to do now
- Upgrade GLPI to 10.0.12 or later. Take a database and file backup first.
- Confirm after the upgrade that LDAP login still works with your directory settings.
- Limit exposure of the GLPI login page. Put it behind a VPN or an allowlist if staff only use it internally.
- Make sure the LDAP service account that GLPI uses has only the read access it needs, so a query manipulation cannot reveal more than necessary.
- Review directory and GLPI logs for unusual login attempts, such as user names with unexpected punctuation.
Why it matters
The record lists CWE-74 (Injection) and CWE-90 (LDAP Injection). LDAP injection works like SQL injection, but against directory queries. If the application builds an LDAP filter by pasting in text from the login form, special characters can change the meaning of the filter. The defense is to escape or reject those characters before the query is built.
The score is moderate because attack complexity is rated high and only confidentiality is affected. Still, a login form is the one page that anyone on the network can reach, and a directory holds names and attributes that attackers use for later steps. That makes the upgrade worth doing on a normal schedule instead of waiting for the next quarter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if we only use local GLPI accounts?
The advisory describes the issue for authentication against LDAP. Local only setups do not use that path, but upgrading is still recommended because 10.0.12 is the supported fix level.
How do I know which version is fixed?
The advisory and the record both give 10.0.12. Use that or a later release.
Sources
- GitHub advisory GHSA-p995-jmfv-c7r8 (fetched)
- GLPI 10.0.12 release (listed in the record)
- Gold page for CVE-2023-51446
Last reviewed: 19 October 2026.
