CVE-2019-10118

2019-03-2704:29:01

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user’s last name in the API.

CPENameOperatorVersion
snipe-iteq3.6.5
snipe-iteq3.6.0
snipe-iteq3.0-beta.3
snipe-iteq4-beta4
snipe-iteq4.6.0
snipe-iteq3.0-beta.2
snipe-iteq4.1.14
snipe-iteq3.0-beta.1
snipe-iteq4.0.5
snipe-iteq4.1.4

Name	Operator	Version
snipe-it	eq	3.6.5
snipe-it	eq	3.6.0
snipe-it	eq	3.0-beta.3
snipe-it	eq	4-beta4
snipe-it	eq	4.6.0
snipe-it	eq	3.0-beta.2
snipe-it	eq	4.1.14
snipe-it	eq	3.0-beta.1
snipe-it	eq	4.0.5
snipe-it	eq	4.1.4