Описание
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| snipe-it | itp | package |
EPSS
Процентиль: 7%
0.00173
Низкий
Связанные уязвимости
CVSS3: 5.4
nvd
9 месяцев назад
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.
CVSS3: 5.4
github
9 месяцев назад
Snipe-IT is vulnerable to stored cross-site scripting
EPSS
Процентиль: 7%
0.00173
Низкий