CVE-2024-5685
Broken Function Level Authorization (BFLA) in snipe/snipe-it
概要
Broken Function Level Authorization (BFLA) in snipe/snipe-it
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory advisory.checkmarx.net
- advisory devhub.checkmarx.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- patch github.com