An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://gist.githubusercontent.com/Tommywarren/b3a6c6ae5a93dd67c863313f71f53a76/raw/ddff8cbbab5179f680ba3f5e94fc080575ad8913/CVE-2024-51094 | Third Party Advisory |
Configurations
History
22 May 2025, 17:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Snipeitapp
Snipeitapp snipe-it |
|
| CPE | cpe:2.3:a:snipeitapp:snipe-it:7.0.13:*:*:*:*:*:*:* | |
| References | () https://gist.githubusercontent.com/Tommywarren/b3a6c6ae5a93dd67c863313f71f53a76/raw/ddff8cbbab5179f680ba3f5e94fc080575ad8913/CVE-2024-51094 - Third Party Advisory |
13 Nov 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server. |
12 Nov 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-12 21:15
Updated : 2025-05-22 17:28
NVD link : CVE-2024-51094
Mitre link : CVE-2024-51094
JSON object : View
Products Affected
snipeitapp
- snipe-it
CWE
No CWE.