Описание
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.
Уязвимые конфигурации
Конфигурация 1Версия до 8.6.2 (исключая)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
EPSS
Процентиль: 47%
0.00589
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-22
Связанные уязвимости
CVSS3: 6.5
debian
2 месяца назад
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an ...
github
26 дней назад
Snipe-IT has a path traversal vulnerability via CSV import `image` field
EPSS
Процентиль: 47%
0.00589
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-22