Orta CVSS 5.7
CVE-2026-55475: Snipe-it: hatalı yetkilendirme
Açıklama (NVD)
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1.
Özet bilgiler
- Ürün
- Snipeitapp Snipe-it
- CVSS v3.1
- 5.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - EPSS
- %0,34 (yüzdelik 28)
- CWE
- CWE-863
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| snipeitapp-snipe-it | — | — | 8.6.1 |