Описание
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| snipe-it | itp | package |
EPSS
Процентиль: 34%
0.00407
Низкий
Связанные уязвимости
CVSS3: 7.6
nvd
больше 2 лет назад
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
CVSS3: 8.1
github
больше 2 лет назад
Snipe-IT allows users to promote or demote themselves or other users
EPSS
Процентиль: 34%
0.00407
Низкий