Skip to content
OpenAdvisories

Product · snipe

snipe-it

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.6
    CVE-2024-5685

    Broken Function Level Authorization (BFLA) in snipe/snipe-it

    Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

    snipe snipe-it snipe/snipe-it Packagist
  • High 8.8
    CVE-2022-23064

    Snipe-IT - Host Header Injection

    In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlle…

    snipe snipe-it snipe/snipe-it Packagist