Lucene search

GitHub Advisory DatabaseGHSA-P2VW-F87C-Q597

HistoryApr 29, 2022 - 12:00 a.m.

Improper Access Control in snipe/snipe-it

2022-04-2900:00:23

CWE-862

GitHub Advisory Database

github.com

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

37.3%

JSON

Snipe-IT prior to 5.4.4 is vulnerable to Missing Authorization.

Affected configurations

Vulners

Node

snipesnipe-itRange<5.4.4

CPENameOperatorVersion
snipe/snipe-itlt5.4.4

CPE	Name	Operator	Version
	snipe/snipe-it	lt	5.4.4

References

github.com/advisories/GHSA-p2vw-f87c-q597

github.com/snipe/snipe-it/commit/2e9cf8fa87a025c0eac9f79f4864b3fdd33a950c

github.com/snipe/snipe-it/pull/10991

huntr.dev/bounties/4a1723e9-5bc4-4c4b-bceb-1c45964cc71d

nvd.nist.gov/vuln/detail/CVE-2022-1511

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

37.3%

JSON

Related for GHSA-P2VW-F87C-Q597