CVE-2024-5685

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5685
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

8.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://advisory.checkmarx.net/?search=CVE-2024-5685 Third Party Advisory
https://advisory.checkmarx.net/?search=CVE-2024-5685 Third Party Advisory
https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ Third Party Advisory
https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ Third Party Advisory
https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 Patch
https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 Patch
https://github.com/snipe/snipe-it/pull/14745 Issue Tracking
https://github.com/snipe/snipe-it/pull/14745 Issue Tracking
https://github.com/snipe/snipe-it/releases/tag/v6.4.2 Release Notes
https://github.com/snipe/snipe-it/releases/tag/v6.4.2 Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
History

07 Mar 2025, 14:55

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
CPE cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
First Time Snipeitapp
Snipeitapp snipe-it
References () https://advisory.checkmarx.net/?search=CVE-2024-5685 - () https://advisory.checkmarx.net/?search=CVE-2024-5685 - Third Party Advisory
References () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ - () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ - Third Party Advisory
References () https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 - () https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 - Patch
References () https://github.com/snipe/snipe-it/pull/14745 - () https://github.com/snipe/snipe-it/pull/14745 - Issue Tracking
References () https://github.com/snipe/snipe-it/releases/tag/v6.4.2 - () https://github.com/snipe/snipe-it/releases/tag/v6.4.2 - Release Notes

19 Jun 2024, 09:15

Type Values Removed Values Added
References
  • () https://advisory.checkmarx.net/?search=CVE-2024-5685 -

18 Jun 2024, 16:15

Type Values Removed Values Added
References
  • () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ -

14 Jun 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-14 10:15

Updated : 2025-03-07 14:55

NVD link : CVE-2024-5685

Mitre link : CVE-2024-5685

JSON object : View

Products Affected

snipeitapp

  • snipe-it
CWE

No CWE.