CVE-2024-5685
published 2024-06-14CVE-2024-5685: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API…
PriorityP345high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.41%
32.5th percentile
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| snipe | snipe-it | >= 0 < 6.4.2 | 6.4.2 |
| snipe | snipe-it | v4.6.17 – v6.4.1 | — |
| snipeitapp | snipe-it | >= 4.6.17 < 6.4.2 | 6.4.2 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_oracle7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Snipe-IT allows users to promote or demote themselves or other users
osv·2024-06-14
CVE-2024-5685 [HIGH] Snipe-IT allows users to promote or demote themselves or other users
Snipe-IT allows users to promote or demote themselves or other users
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
GHSA
Snipe-IT allows users to promote or demote themselves or other users
ghsa·2024-06-14
CVE-2024-5685 [HIGH] CWE-862 Snipe-IT allows users to promote or demote themselves or other users
Snipe-IT allows users to promote or demote themselves or other users
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (XNIO) — CVE-2023-5685
vendor_oracle·2024-10-15·CVSS 5.9
CVE-2023-5685 [HIGH] Oracle Oracle Communications Risk Matrix: Configuration (XNIO) — CVE-2023-5685
Oracle Oracle Communications Risk Matrix: Configuration (XNIO) vulnerability
CVE: CVE-2023-5685
CVSS: 5.9
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Communications Risk Matrix: Install (XNIO) — CVE-2023-5685
vendor_oracle·2024-07-15·CVSS 7.5
CVE-2023-5685 [HIGH] Oracle Oracle Communications Risk Matrix: Install (XNIO) — CVE-2023-5685
Oracle Oracle Communications Risk Matrix: Install (XNIO) vulnerability
CVE: CVE-2023-5685
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://advisory.checkmarx.net/?search=CVE-2024-5685https://devhub.checkmarx.com/cve-details/CVE-2024-5685/https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1https://github.com/snipe/snipe-it/pull/14745https://github.com/snipe/snipe-it/releases/tag/v6.4.2https://advisory.checkmarx.net/?search=CVE-2024-5685https://devhub.checkmarx.com/cve-details/CVE-2024-5685/https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1https://github.com/snipe/snipe-it/pull/14745https://github.com/snipe/snipe-it/releases/tag/v6.4.2
2024-06-14
Published