Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/snipe/snipe-it/releases/tag/v7.0.10 | Release Notes |
| https://www.synacktiv.com/advisories/snipe-it-unauthenticated-remote-command-execution-when-appkey-known | Exploit Third Party Advisory |
Configurations
History
22 May 2025, 17:56
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* | |
| First Time |
Snipeitapp
Snipeitapp snipe-it |
|
| References | () https://github.com/snipe/snipe-it/releases/tag/v7.0.10 - Release Notes | |
| References | () https://www.synacktiv.com/advisories/snipe-it-unauthenticated-remote-command-execution-when-appkey-known - Exploit, Third Party Advisory |
07 Jan 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Oct 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-11 13:15
Updated : 2025-05-22 17:56
NVD link : CVE-2024-48987
Mitre link : CVE-2024-48987
JSON object : View
Products Affected
snipeitapp
- snipe-it
CWE
No CWE.