PT-2022-13297 · Snipe-It · Snipe-It
CVE-2022-0611
·
Published
2022-02-15
·
Updated
2023-08-02
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Snipe-IT versions prior to 5.3.11
Description
The issue concerns improper privilege management, allowing an unprivileged user to create maintenance for an asset. This can be exploited due to missing authorization in the software. Version 5.3.11 contains a patch for this issue.
Recommendations
For versions prior to 5.3.11, update to version 5.3.11 to resolve the issue. As a temporary workaround, consider restricting access to maintenance creation for unprivileged users until the patch is applied.
Exploit
Fix
Missing Authorization
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Snipe-It