PT-2022-13275 · Snipe-It · Snipe-It

Published 2022-02-14 · Updated 2023-08-02 · CVE-2022-0579

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 5.3.9

Description The issue concerns improper privilege management, allowing a user without access to the supplier module to view supplier content.

Recommendations For versions prior to 5.3.9, update to version 5.3.9 or later to resolve the issue.

Exploit

Fix

Improper Privilege Management

Missing Authorization

Weakness Enumeration

CWE-269

CWE-862

Related Identifiers

CVE-2022-0579

GHSA-V6VG-PXVV-G5CQ

Affected Products

Snipe-It

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0579.json · Exploit
• 🔥 https://huntr.dev/bounties/70a99cf4-3241-4ffc-b9ed-5c54932f3849 · Exploit
• https://github.com/snipe/snipe-it/commit/db0c0e790892db874573d95f8ae4268b8a011ab1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0579 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0579 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v6vg-pxvv-g5cq · Vendor Advisory
• https://github.com/snipe/snipe-it · Note
• https://t.me/cibsecurity/37441 · Telegram Post
• https://t.me/cvenotify/54872 · Telegram Post
• https://t.me/cvenotify/26755 · Telegram Post