Snipe-IT is an IT asset/license management system
The Snipe-IT asset management system has a privilege escalation vulnerability that allows authenticated users with limited permissions to elevate their own privileges to admin. This is due to a flaw in the API controller that fails to properly restrict permission updates.
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.
Authenticated users of the Snipe-IT asset management system are at risk of privilege escalation attacks, posing a high severity threat to the security of the application.
Remediation Recommended
This vulnerability carries significant risk. Schedule patching in your next cycle.
What should I do?
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| snipeitapp | snipe-it | 8.4.1 | - |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
Affected Products
2
References
snipeitapp / snipe-it
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability
Impact