Lucene search

GoogleOSV:CVE-2024-5685

HistoryJun 14, 2024 - 10:15 a.m.

CVE-2024-5685

2024-06-1410:15:10

Google

osv.dev

cve-2024-5685

user permissions

api call

group memberships

snipe-it

software issue

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

Users with “User:edit” and “Self:api” permissions can promote or demote themselves or other users by performing changes to the group’s memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

CPENameOperatorVersion
snipe-iteq6.1.0-pre
snipe-iteq5.0.0-beta-6-GM
snipe-iteq6.0.7
snipe-iteq4.6.11
snipe-iteq6.0.4
snipe-iteq3.6.3
snipe-iteq6.2.0
snipe-iteq4.7.8
snipe-iteq3.0-beta.3
snipe-iteq6.0.1

Name	Operator	Version
snipe-it	eq	6.1.0-pre
snipe-it	eq	5.0.0-beta-6-GM
snipe-it	eq	6.0.7
snipe-it	eq	4.6.11
snipe-it	eq	6.0.4
snipe-it	eq	3.6.3
snipe-it	eq	6.2.0
snipe-it	eq	4.7.8
snipe-it	eq	3.0-beta.3
snipe-it	eq	6.0.1

Rows per page:

1-10 of 1911

References

advisory.checkmarx.net/?search=CVE-2024-5685

devhub.checkmarx.com/cve-details/CVE-2024-5685/

github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1

github.com/snipe/snipe-it/pull/14745

github.com/snipe/snipe-it/releases/tag/v6.4.2

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

Related for OSV:CVE-2024-5685