Описание
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is fixed in version 8.6.2.
Уязвимые конфигурации
Конфигурация 1Версия до 8.6.2 (исключая)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
EPSS
Процентиль: 31%
0.00376
Низкий
7.7 High
CVSS3
Дефекты
CWE-639
Связанные уязвимости
CVSS3: 7.7
debian
2 месяца назад
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PAT ...
CVSS3: 7.7
github
26 дней назад
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
EPSS
Процентиль: 31%
0.00376
Низкий
7.7 High
CVSS3
Дефекты
CWE-639