GHSA-hw9x-8m75-4vjq

Cross Site Scripting vulnerability in Snipe-IT

Source: GitHub Advisory Database (reviewed) High CVE-2024-51093

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	snipe/snipe-it	<= 7.0.13	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting vulnerability in Snipe-IT v.7.0.13 allows a remote attacker to escalate privileges via an unknown part of the file /users/{{user-id}}/#files.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-51093 advisory
https://gist.githubusercontent.com/Tommywarren/ca70f1c43f4ec34dc19cd13459535780/raw/d13192ae50bc7c024b922412dfa3f530faa8d5db/CVE-2024-51093 web
https://github.com/snipe/snipe-it package