Auth bypass in Snipe Snipe-it
CVE-2024-5685
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
Vulnerability class: Broken Access Control
EPSS: 0.004 (32.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L.
Affected products
- Snipe Snipe-it — versions v4.6.17
- Snipeitapp Snipe-it
Weakness classification (CWE)
References
- 596c5446-0ce5-4ba2-aa66-48b3b757a647 (Issue Tracking)
- 596c5446-0ce5-4ba2-aa66-48b3b757a647 (Patch)
- 596c5446-0ce5-4ba2-aa66-48b3b757a647 (release-notes, Release Notes)
- 596c5446-0ce5-4ba2-aa66-48b3b757a647 (Third Party Advisory, third-party-advisory)
- 596c5446-0ce5-4ba2-aa66-48b3b757a647 (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2024-5685?
- CVE-2024-5685 is a high-severity vulnerability in Snipe Snipe-it, classified under Missing Authorization. CVSS score: 7.6/10. Published 2024-06-14.
- How severe is CVE-2024-5685?
- High severity. CVSS v3 base score is 7.6 out of 10.