Описание
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
Ссылки
- Third Party Advisory
- Third Party Advisory
- Patch
- Issue Tracking
- Release Notes
- Third Party Advisory
- Third Party Advisory
- Patch
- Issue Tracking
- Release Notes
Уязвимые конфигурации
Конфигурация 1Версия от 4.6.17 (включая) до 6.4.2 (исключая)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
EPSS
Процентиль: 37%
0.00159
Низкий
7.6 High
CVSS3
8.1 High
CVSS3
Дефекты
CWE-862
CWE-862
Связанные уязвимости
CVSS3: 7.6
debian
больше 1 года назад
Users with "User:edit" and "Self:api" permissionscan promote or demote ...
CVSS3: 8.1
github
больше 1 года назад
Snipe-IT allows users to promote or demote themselves or other users
EPSS
Процентиль: 37%
0.00159
Низкий
7.6 High
CVSS3
8.1 High
CVSS3
Дефекты
CWE-862
CWE-862