PT-2022-13677 · Snipe-It · Snipe-It

Published 2022-03-30 · Updated 2022-04-05 · CVE-2022-1155

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 5.3.10 Snipe-IT versions 5.4.1 and 6.0.0-RC-5

Description The issue arises from the fact that old sessions are not blocked by the login enable function, and active sessions are not revoked when a user account is disabled. This allows a disabled user to still access information they should no longer be able to access.

Recommendations For Snipe-IT versions prior to 5.3.10, update to version 5.3.10 or later. For Snipe-IT versions 5.4.1 and 6.0.0-RC-5, update to version 6.0.0-RC-6 or 5.4.2. As a temporary workaround, consider using the KillAllSessions console command, clearing the contents of the storage/framework/sessions directory, or changing the cookie name to mitigate the issue, but be aware that these options will logout all users.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

CWE-840

Related Identifiers

CVE-2022-1155

GHSA-636J-7X7R-GVW2

Affected Products

Snipe-It

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1155.json · Exploit
• 🔥 https://huntr.dev/bounties/ebc26354-2414-4f72-88aa-f044aec2b2e1 · Exploit
• https://github.com/snipe/snipe-it/commit/bdabbbd4e98e88ee01e728ceb4fd512661fbd38d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1155 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1155 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-636j-7x7r-gvw2 · Vendor Advisory
• https://github.com/snipe/snipe-it/releases/tag/v5.4.2 · Note
• https://github.com/snipe/snipe-it · Note
• https://github.com/snipe/snipe-it/releases/tag/v6.0.0-RC-6 · Note
• https://github.com/snipe/snipe-it/pull/10876 · Note
• https://t.me/cibsecurity/39804 · Telegram Post