Vulnerabilities > CVE-2024-5685 - Unspecified vulnerability in Snipeitapp Snipe-It

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

snipeitapp

NVD

Published: 2024-06-14

Updated: 2025-03-07

Summary

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

Vulnerable Configurations

Part	Description	Count
Application	Snipeitapp Snipeitapp Snipe IT 4.6.17 Snipeitapp Snipe IT 4.6.18 Snipeitapp Snipe IT 4.7.0 Snipeitapp Snipe IT 4.7.1 Snipeitapp Snipe IT 4.7.2 Snipeitapp Snipe IT 4.7.3 Snipeitapp Snipe IT 4.7.4 Snipeitapp Snipe IT 4.7.5 Snipeitapp Snipe IT 4.7.6 Snipeitapp Snipe IT 5.0.0 Snipeitapp Snipe IT 5.0.1 Snipeitapp Snipe IT 5.0.2 Snipeitapp Snipe IT 5.0.3 Snipeitapp Snipe IT 5.0.4 Snipeitapp Snipe IT 5.0.5 Snipeitapp Snipe IT 5.0.6 Snipeitapp Snipe IT 5.0.7 Snipeitapp Snipe IT 5.0.8 Snipeitapp Snipe IT 5.0.9 Snipeitapp Snipe IT 5.0.10 Snipeitapp Snipe IT 5.0.11 Snipeitapp Snipe IT 5.0.12 Snipeitapp Snipe IT 5.1.0 Snipeitapp Snipe IT 5.1.1 Snipeitapp Snipe IT 5.1.2 Snipeitapp Snipe IT 5.1.3 Snipeitapp Snipe IT 5.1.4 Snipeitapp Snipe IT 5.1.5 Snipeitapp Snipe IT 5.1.6 Snipeitapp Snipe IT 5.1.7 Snipeitapp Snipe IT 5.1.8 Snipeitapp Snipe IT 5.2.0 Snipeitapp Snipe IT 5.3.0 Snipeitapp Snipe IT 5.3.1 Snipeitapp Snipe IT 5.3.2 Snipeitapp Snipe IT 5.3.3 Snipeitapp Snipe IT 5.3.4 Snipeitapp Snipe IT 5.3.5 Snipeitapp Snipe IT 5.3.6 Snipeitapp Snipe IT 5.3.7 Snipeitapp Snipe IT 5.3.8 Snipeitapp Snipe IT 5.3.9 Snipeitapp Snipe IT 5.3.10 Snipeitapp Snipe IT 5.4.0 Snipeitapp Snipe IT 5.4.1 Snipeitapp Snipe IT 5.4.2 Snipeitapp Snipe IT 5.4.3 Snipeitapp Snipe IT 5.4.4 Snipeitapp Snipe IT 6.0.0 Snipeitapp Snipe IT 6.0.1 Snipeitapp Snipe IT 6.0.2 Snipeitapp Snipe IT 6.0.3 Snipeitapp Snipe IT 6.0.4 Snipeitapp Snipe IT 6.0.5 Snipeitapp Snipe IT 6.0.6 Snipeitapp Snipe IT 6.0.7 Snipeitapp Snipe IT 6.0.8 Snipeitapp Snipe IT 6.0.9 Snipeitapp Snipe IT 6.0.10 Snipeitapp Snipe IT 6.0.11 Snipeitapp Snipe IT 6.0.12 Snipeitapp Snipe IT 6.0.13 Snipeitapp Snipe IT 6.0.14 Snipeitapp Snipe IT 6.1.0 Snipeitapp Snipe IT 6.1.1 Snipeitapp Snipe IT 6.1.2 Snipeitapp Snipe IT 6.2.0 Snipeitapp Snipe IT 6.2.1 Snipeitapp Snipe IT 6.2.2 Snipeitapp Snipe IT 6.2.3 Snipeitapp Snipe IT 6.3.0 Snipeitapp Snipe IT 6.3.1 Snipeitapp Snipe IT 6.3.2 Snipeitapp Snipe IT 6.3.3 Snipeitapp Snipe IT 6.3.4 Snipeitapp Snipe IT 6.4.0 Snipeitapp Snipe IT 6.4.1	87

Summary

Vulnerable Configurations

References