CVE-2021-43779 - CVE House

Back to Database

Status published Critical CVE-2021-43779

Remote Command Execution vulnerability

9.9 CVSS

Vulnerability Description

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-43779

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pluginsGLPI

View All →

GLPI Database Inventory Plugin Vulnerable to Stored Object Injection

pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests

Escalade GLPI Plugin Vulnerable to Improper Access Control

The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation

Fields GLPI plugin has an Authenticated SQL Injection

Affected Vendor

pluginsGLPI

View all reports →

Affected Software

addressing

Vulnerable Versions:

< 2.9.1

Timeline

Official Publish: January 5th, 2022

Last Modified: September 8th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation