CVE-2024-5685: Snipe-IT - User Promotion/Demotion Vulnerability
Summary
CVE-2024-5685: Snipe-IT allows users to promote or demote themselves or other users. Affects snipe/snipe-it versions < 6.4.2. Fixed in 6.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Snipe-IT is an open-source asset management system that allows users to track and manage their organization's assets. It provides features such as inventory management, check-in/check-out, and asset auditing. The vulnerability in Snipe-IT allows users with specific permissions to promote or demote themselves or other users within the system.
Vulnerability Detail
The vulnerability arises from the ability of users with "User:edit" and "Self:api" permissions to manipulate group memberships via API calls. This allows them to promote or demote themselves or other users within the system. The vulnerability affects Snipe-IT versions from v4.6.17 through v6.4.1. Exploitation of this vulnerability can lead to unauthorized elevation of privileges and potential misuse of administrative functionalities.
How To Fix
Minimum fixed version
6.4.2
This is the first release that contains the fix.
composer require snipe/snipe-it:6.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch by upgrading to Snipe-IT version 6.4.2 or later.
Conclusion
The User Promotion/Demotion vulnerability in Snipe-IT allows users with specific permissions to manipulate group memberships and promote or demote themselves or other users within the system. Upgrading to Snipe-IT version 6.4.2 or later is necessary to fix this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for snipe/snipe-it →
FAQ
Snipe-IT is an open-source asset management system used for tracking and managing organizational assets.
The vulnerability affects Snipe-IT versions from v4.6.17 through v6.4.1.
Users with "User:edit" and "Self:api" permissions can exploit this vulnerability.
Exploitation of this vulnerability can lead to unauthorized elevation of privileges and potential misuse of administrative functionalities within Snipe-IT.
There is no known workaround for this vulnerability. It is recommended to apply the official patch by upgrading to Snipe-IT version 6.4.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for snipe/snipe-it.
