GitHub Advisoryadvisory · Packagist

GHSA-w3v3-cxq5-9vr4 Incorrect Default Permissions and Improper Access Control in snipe-it

MEDIUM Published 2022-01-21 Modified 2023-06-30 Official page ↗
Aliases
CVE-2022-0179
Ecosystem
Packagist
Packages
snipe/snipe-it
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-276, CWE-284, CWE-862
Reviewed
2022-01-18

Affected packages

• Packagist snipe/snipe-it: < 5.3.7 → fixed in 5.3.7

Description

snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions.

Related

Alias · CVE (1)

  • CVE-2022-0179 snipe-it is vulnerable to Missing Authorization vulnerability

Weakness · CWE (3)

  • CWE-276 Incorrect Default Permissions weakness
  • CWE-284 Improper Access Control weakness
  • CWE-862 Missing Authorization weakness

References