CVE-2024-5685: Snipe-IT allows users to promote or demote themselves or other users

June 14, 2024 (updated June 17, 2024)

Users with “User:edit” and “Self:api” permissions can promote or demote themselves or other users by performing changes to the group’s memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

References

github.com/advisories/GHSA-544r-fc65-v832
github.com/snipe/snipe-it
github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1
github.com/snipe/snipe-it/pull/14745
github.com/snipe/snipe-it/releases/tag/v6.4.2
nvd.nist.gov/vuln/detail/CVE-2024-5685

Code Behaviors & Features

Detect and mitigate CVE-2024-5685 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →