Lucene search
HaxatronEFDF2EAD-F9D1-4767-9F02-D11F762D15E7HistoryJan 06, 2022 - 1:16 a.m.
Improper Access Control in snipe/snipe-it
2022-01-0601:16:06
haxatron
www.huntr.dev
6
0.001 Low
EPSS
Percentile
21.4%
Description
All bulk actions (bulk-edit / bulk-delete / form info) in asset models do not have access control checks
Proof of concept
1: Grant view to Asset Models
2: UI for bulk-edit and bulk-delete is still enabled, proceed.
3: You may bulk-delete / edit any asset model
Impact
This vulnerability is capable of viewing / editing / delete asset model information with DENY permissions,
Related
github
github
Incorrect Default Permissions and Improper Access Control in snipe-it
2022-01-21 23:58:07
cve
cve
CVE-2022-0179
2022-01-12 05:15:08
osv
osv
Incorrect Default Permissions and Improper Access Control in snipe-it
2022-01-21 23:58:07
CVE-2022-0179
2022-01-12 05:15:08
cnvd
cnvd
An unspecified vulnerability exists in snipe-it (CNVD-2022-10714)
2022-01-12 00:00:00
prion
prion
Authorization
2022-01-12 05:15:00
nvd
nvd
CVE-2022-0179
2022-01-12 05:15:08
veracode
veracode
Improper Access Control
2022-01-13 08:20:26
cvelist
cvelist
CVE-2022-0179 Missing Authorization in snipe/snipe-it
2022-01-12 00:00:00