CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are susceptible to a stored cross-site scripting vulnerability that allows users with edit permissions to inject malicious scripts into department names. This vulnerability can lead to the execution of these scripts in the browsers of all department members when they access their My Assets page, potentially compromising user data and session integrity. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the browsers of all department members when they load their My Assets page.