GitHub Advisoryadvisory · Packagist

GHSA-j57w-3c39-gpp5 Improper Privilege Management in Snipe-IT

HIGH Published 2022-02-17 Modified 2022-02-25 Official page ↗

Aliases: CVE-2022-0611
Ecosystem: Packagist
Packages: snipe/snipe-it
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-269, CWE-862
Reviewed: 2022-02-25

Affected packages

• Packagist snipe/snipe-it: < 5.3.11 → fixed in 5.3.11

Description

An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.

Related

Alias · CVE (1)

CVE-2022-0611 Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. vulnerability

Weakness · CWE (2)

CWE-269 Improper Privilege Management weakness
CWE-862 Missing Authorization weakness

References