Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Malicious XML File Upload in Snipe-IT Allows Unwanted Admin Access

CVE-2024-51093 · published 1 year ago
Summary

An attacker can upload a malicious XML file to Snipe-IT, which can grant them administrative access to the system. This is a risk because it allows an attacker to make changes to the system without permission. To protect your system, update to the latest version of Snipe-IT.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
composer snipe snipe-it <= 7.0.13
– snipeitapp snipe-it 7.0.13
cpe:2.3:a:snipeitapp:snipe-it:7.0.13:*:*:*:*:*:*:*
Original advisory text
Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the pa...
Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Nov 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-hw9x-8m75-4vjq · GHSA
CVE-2024-51093 · NVD
CVE-2024-51093 · OSV
Track software like this
Free during beta