CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.0. It may be remotely exploitable.
CVE
CVE-2024-51094
Severity
HIGH
CVSS
8
EPSS
0.43%
Original NVD Description
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.
Related CVEs
Other vulnerabilities affecting the same vendor(s)