Описание
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. This issue is fixed in version 8.6.2.
Ссылки
- Patch
- Release Notes
- ExploitPatchVendor Advisory
- ExploitPatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 8.6.2 (исключая)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
EPSS
Процентиль: 38%
0.00439
Низкий
8.7 High
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 8.7
debian
2 месяца назад
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, Upl ...
CVSS3: 8.7
github
26 дней назад
Snipe-IT vulnerable to stored XSS via inline-served attachment
EPSS
Процентиль: 38%
0.00439
Низкий
8.7 High
CVSS3
Дефекты
CWE-79