Описание
Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc. The issue is patched in version 8.6.0.
Ссылки
- Issue TrackingPatch
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 8.6.0 (исключая)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
EPSS
Процентиль: 8%
0.00182
Низкий
5.5 Medium
CVSS3
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 5.5
debian
около 2 месяцев назад
Snipe-IT is an IT asset/license management system. In versions prior t ...
CVSS3: 5.5
github
около 2 месяцев назад
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
EPSS
Процентиль: 8%
0.00182
Низкий
5.5 Medium
CVSS3
Дефекты
CWE-863