CyberRota Analysis
AI-GeneratedThe vulnerability allows authorized users of Snipe-IT, prior to version 8.6.2, to manipulate maintenance records by reassigning them to assets beyond their authorized scope, due to insufficient re-authorization checks on user-supplied asset IDs. This could lead to unauthorized access and management of IT assets, potentially compromising asset integrity and accountability. Organizations using affected versions should prioritize upgrading to 8.6.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is fixed in version 8.6.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)