CVE-2024-5685

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5685

7.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

U

sers with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

References
Link Resource
https://advisory.checkmarx.net/?search=CVE-2024-5685 Third Party Advisory
https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ Third Party Advisory
https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 Patch
https://github.com/snipe/snipe-it/pull/14745 Issue Tracking
https://github.com/snipe/snipe-it/releases/tag/v6.4.2 Release Notes
https://advisory.checkmarx.net/?search=CVE-2024-5685 Third Party Advisory
https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ Third Party Advisory
https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 Patch
https://github.com/snipe/snipe-it/pull/14745 Issue Tracking
https://github.com/snipe/snipe-it/releases/tag/v6.4.2 Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
History

07 Mar 2025, 16:07

Type Values Removed Values Added
References () https://advisory.checkmarx.net/?search=CVE-2024-5685 - () https://advisory.checkmarx.net/?search=CVE-2024-5685 - Third Party Advisory
References () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ - () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ - Third Party Advisory
References () https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 - () https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 - Patch
References () https://github.com/snipe/snipe-it/pull/14745 - () https://github.com/snipe/snipe-it/pull/14745 - Issue Tracking
References () https://github.com/snipe/snipe-it/releases/tag/v6.4.2 - () https://github.com/snipe/snipe-it/releases/tag/v6.4.2 - Release Notes
First Time Snipeitapp snipe-it
Snipeitapp
CPE cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*

21 Nov 2024, 09:48

Type Values Removed Values Added
References () https://advisory.checkmarx.net/?search=CVE-2024-5685 - () https://advisory.checkmarx.net/?search=CVE-2024-5685 -
References () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ - () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ -
References () https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 - () https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 -
References () https://github.com/snipe/snipe-it/pull/14745 - () https://github.com/snipe/snipe-it/pull/14745 -
References () https://github.com/snipe/snipe-it/releases/tag/v6.4.2 - () https://github.com/snipe/snipe-it/releases/tag/v6.4.2 -

19 Jun 2024, 09:15

Type Values Removed Values Added
References
  • () https://advisory.checkmarx.net/?search=CVE-2024-5685 -

18 Jun 2024, 16:15

Type Values Removed Values Added
References
  • () https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ -

17 Jun 2024, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.6

17 Jun 2024, 12:42

Type Values Removed Values Added
Summary
  • (es) Los usuarios con permisos "Usuario: editar" y "Self: api" pueden promocionarse o degradarse a sí mismos o a otros usuarios realizando cambios en las membresías del grupo a través de una llamada API. Este problema afecta a snipe-it: desde v4.6.17 hasta v6.4.1.

14 Jun 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-14 10:15

Updated : 2025-03-07 16:07

NVD link : CVE-2024-5685

Mitre link : CVE-2024-5685

CVE.ORG link : CVE-2024-5685

JSON object : View

Products Affected

snipeitapp

CWE
CWE-862

Missing Authorization