PT-2024-37081 · Snipe-It · Snipe-It

Published 2024-06-14 · Updated 2024-06-19 · CVE-2024-5685

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: snipe-it versions 4.6.17 through 6.4.1

Description: The issue allows users with User:edit and Self:api permissions to promote or demote themselves or other users by performing changes to the group's memberships via an API call.

Recommendations: For versions 4.6.17 through 6.4.1, consider restricting the User:edit and Self:api permissions to prevent unauthorized changes to group memberships until a patch is available. As a temporary workaround, consider disabling API calls that allow group membership changes to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-5685

GHSA-544R-FC65-V832

Affected Products

Snipe-It

References · 14

• https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-5685 · Security Note
• https://osv.dev/vulnerability/GHSA-544r-fc65-v832 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-5685 · Vendor Advisory
• https://github.com/snipe/snipe-it · Note
• https://github.com/snipe/snipe-it/releases/tag/v6.4.2 · Note
• https://github.com/snipe/snipe-it/pull/14745 · Note
• https://t.me/cvenotify/83641 · Telegram Post
• https://twitter.com/CveFindCom/status/1801555418553930048 · Twitter Post
• https://t.me/cvenotify/83286 · Telegram Post
• https://advisory.checkmarx.net/?search=CVE-2024-5685 · Note
• https://twitter.com/CVEnew/status/1801673809025741274 · Twitter Post
• https://devhub.checkmarx.com/cve-details/CVE-2024-5685 · Note
• https://t.me/cvenotify/83737 · Telegram Post