Описание
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| snipe-it | itp | package |
Связанные уязвимости
CVSS3: 5.4
nvd
2 месяца назад
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.
CVSS3: 5.4
github
2 месяца назад
Snipe-IT is vulnerable to stored cross-site scripting