Описание
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.
Уязвимые конфигурации
Конфигурация 1Версия до 8.6.2 (исключая)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
EPSS
Процентиль: 22%
0.00295
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 5.4
debian
3 месяца назад
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, Com ...
CVSS3: 5.4
github
26 дней назад
Snipe-IT vulnerable to stored XSS via Markdown custom field
EPSS
Процентиль: 22%
0.00295
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-79