CVE-2024-5685

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5685
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

7.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://advisory.checkmarx.net/?search=CVE-2024-5685
https://devhub.checkmarx.com/cve-details/CVE-2024-5685/
https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1
https://github.com/snipe/snipe-it/pull/14745
https://github.com/snipe/snipe-it/releases/tag/v6.4.2
https://advisory.checkmarx.net/?search=CVE-2024-5685
https://devhub.checkmarx.com/cve-details/CVE-2024-5685/
https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1
https://github.com/snipe/snipe-it/pull/14745
https://github.com/snipe/snipe-it/releases/tag/v6.4.2
Configurations

No configuration.

History

21 Nov 2024, 09:48

Type Values Removed Values Added
References () https://advisory.checkmarx.net/?search=CVE-2024-5685 - () https://advisory.checkmarx.net/?search=CVE-2024-5685 -
References () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ - () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ -
References () https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 - () https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 -
References () https://github.com/snipe/snipe-it/pull/14745 - () https://github.com/snipe/snipe-it/pull/14745 -
References () https://github.com/snipe/snipe-it/releases/tag/v6.4.2 - () https://github.com/snipe/snipe-it/releases/tag/v6.4.2 -

19 Jun 2024, 09:15

Type Values Removed Values Added
References
  • () https://advisory.checkmarx.net/?search=CVE-2024-5685 -

18 Jun 2024, 16:15

Type Values Removed Values Added
References
  • () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ -

17 Jun 2024, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.6

17 Jun 2024, 12:42

Type Values Removed Values Added
Summary
  • (es) Los usuarios con permisos "Usuario: editar" y "Self: api" pueden promocionarse o degradarse a sí mismos o a otros usuarios realizando cambios en las membresías del grupo a través de una llamada API. Este problema afecta a snipe-it: desde v4.6.17 hasta v6.4.1.

14 Jun 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-14 10:15

Updated : 2024-11-21 09:48

NVD link : CVE-2024-5685

Mitre link : CVE-2024-5685

CVE.ORG link : CVE-2024-5685

JSON object : View

Products Affected

No product.

CWE
CWE-862

Missing Authorization