CVE-2024-51093

Опубликовано: 12 нояб. 2024

Источник: nvd

CVSS3: 8.7

EPSS Низкий

Описание

Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.

Ссылки

https://gist.githubusercontent.com/Tommywarren/ca70f1c43f4ec34dc19cd13459535780/raw/d13192ae50bc7c024b922412dfa3f530faa8d5db/CVE-2024-51093
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:snipeitapp:snipe-it:7.0.13:*:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00226

Низкий

8.7 High

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVE-2024-51093

CVSS3: 8.7

debian

около 1 года назад

Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 ...

GHSA-hw9x-8m75-4vjq

CVSS3: 8.7

github

около 1 года назад

Cross Site Scripting vulnerability in Snipe-IT

EPSS

Процентиль: 45%

0.00226

Низкий

8.7 High

CVSS3

Дефекты

CWE-79