CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

Improper access control

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089 Improper Access Control in snipe/snipe-it

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

Snipe-IT is affected by an Improper Access Control vulnerability (CVE-2021-4089) affecting versions prior to 5.3.4. The issue arises because regular users with DENY to all models permissions can still view model data via the /models/{id}/clone endpoint due to missing authorize('view') checks. Imp...

Snipe-IT 访问控制错误漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...

PT-2021-23007 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 5.3.4 Description: The issue is related to Improper Access Control. Regular users with DENY set to all models permissions can still view model information via the "/models/id/clone" endpoint due to no authorize'view...

Improper Access Control in snipe/snipe-it

Description Regular users with DENY set to all models permissions can still view model information via the /models/id/clone endpoint due to no authorize'view' permission being set. Proof of Concept 1: Create regular user and set DENY to all permissions in asset models. 2: Login as the user 3:...

Snipe-IT code issue vulnerability

Snipe-IT is an open source IT asset/license management system. snipe-IT is vulnerable to a code issue that could be exploited by attackers to conduct server-side request forgery SSRF attacks...

Server-Side Request Forgery (SSRF)

snipe/snipe-it is vulnerable to server-side request forgery. An attacker can send requests on behalf of the server into the internal network via slack integration...

CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

Server side request forgery (ssrf)

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075 Server-Side Request Forgery (SSRF) in snipe/snipe-it

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075

CVE-2021-4075 (snipe/snipe-it) is corroborated across multiple sources as a Server-Side Request Forgery (SSRF) issue. The connected advisories identify the vulnerability as exploitable via the Slack integration, enabling blind POST-based SSRF where an attacker with admin access could issue reques...

Snipe-IT 代码问题漏洞

Snipe-IT is an open source IT asset/license management system. snipe-IT is vulnerable to a code issue that could be exploited by attackers to conduct server-side request forgery SSRF attacks...

snipe-it is vulnerable to Cross-site Scripting

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross-site Scripting (XSS)

snipe/snipe-it is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the transformCheckedoutAccessory function in AccessoriesTransformer.php as it does not properly escape the user inputs checkout notes...