Snipe-IT allows users to promote or demote themselves or other users

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

CVE-2024-5685

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

CVE-2024-5685

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

CVE-2024-5685

CVE-2024-5685 affects Snipe-IT (versions v4.6.17–v6.4.1). The root cause is missing authorization checks in the API endpoint that allows users with User:edit and Self:api permissions to modify group memberships, enabling promotion/demotion of users. Remediation: upgrade to v6.4.2 or later (as ref...

Snipe-IT Security Breach

Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in Snipe-IT versions v4.6.17 through v6.4.1, which stems from an API call that allows users to make changes to group membership to promote or demote themselves or other users...

PT-2024-37081

Name of the Vulnerable Software and Affected Versions: snipe-it versions 4.6.17 through 6.4.1 Description: The issue allows users with User:edit and Self:api permissions to promote or demote themselves or other users by performing changes to the group's memberships via an API call. Recommendation...

CVE-2024-5685: Missing Authorization

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...

Host header injection in the password reset

Summary The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able ...

GHSA-MRQG-MWH7-Q94J Host header injection in the password reset

Summary The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able ...

Cross-Site Request Forgery (CSRF)

snipe/snipe-it is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability occurs because the library defaults to using the GET method for the resend remainder acceptance option instead of POST, enabling an attacker to send malicious reminders and perform unauthorized actions...

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...

CVE-2023-5511

Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...

CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...

CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...

CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...

CVE-2023-5511

CVE-2023-5511 : Cross-Site Request Forgery in the GitHub repository snipe/snipe-it prior to v6.2.3. The weakness is triggered by CSRF in the snipe-it web app, with analysis across sources indicating the issue derives from request handling for the resend remainder acceptance option (defaulting to ...