CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable to an incorrect calculation in checkout request handling, allowing authenticated users to manipulate the assets.requests_counter through duplicate submissions and cancellations. This can lead to misrepresentation of pending demand in the admin queue, potentially disrupting asset management processes. Organizations using Snipe-IT should prioritize patching to mitigate the risk of asset mismanagement and ensure accurate tracking of requests.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or submit duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)