Описание
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.
Ссылки
- Patch
- Release Notes
- ExploitPatchVendor Advisory
- ExploitPatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 8.6.2 (исключая)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
EPSS
Процентиль: 38%
0.00439
Низкий
7.1 High
CVSS3
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 7.1
debian
3 месяца назад
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an ...
CVSS3: 7.1
github
26 дней назад
Snipe-IT has an authorization bypass on bulk editing users
EPSS
Процентиль: 38%
0.00439
Низкий
7.1 High
CVSS3
Дефекты
CWE-863