Описание
Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)
Impact
Users with component view access could be impacted by an unescaped notes column.
Patches
This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater.
Workarounds
None.
Пакеты
Наименование
snipe/snipe-it
composer
Затронутые версииВерсия исправления
< 8.4.1
8.4.1
Связанные уязвимости
CVSS3: 4.8
nvd
3 месяца назад
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1.
CVSS3: 4.8
debian
3 месяца назад
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, use ...