PT-2022-13297 · Snipe-It · Snipe-It

Published 2022-02-15 · Updated 2023-08-02 · CVE-2022-0611

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 5.3.11

Description The issue concerns improper privilege management, allowing an unprivileged user to create maintenance for an asset. This can be exploited due to missing authorization in the software. Version 5.3.11 contains a patch for this issue.

Recommendations For versions prior to 5.3.11, update to version 5.3.11 to resolve the issue. As a temporary workaround, consider restricting access to maintenance creation for unprivileged users until the patch is applied.

Exploit

Fix

Improper Privilege Management

Missing Authorization

Weakness Enumeration

CWE-269

CWE-862

Related Identifiers

CVE-2022-0611

GHSA-J57W-3C39-GPP5

Affected Products

Snipe-It

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0611.json · Exploit
• 🔥 https://huntr.dev/bounties/7b7447fc-f1b0-446c-b016-ee3f6511010b · Exploit
• https://github.com/snipe/snipe-it/commit/321be4733d3997fc738f0118e1b9af5905f95439 · Patch
• https://osv.dev/vulnerability/GHSA-j57w-3c39-gpp5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0611 · Security Note
• https://github.com/snipe/snipe-it · Note
• https://t.me/cibsecurity/37551 · Telegram Post