Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.0

Snipe-IT: Low-Privileged User Can Exfiltrate System Data via CSV Export

CVE-2024-51094 · published 1 year ago
Summary

A vulnerability in Snipe-IT version 7.0.13 allows a low-privileged user to inject malicious code into their profile name, which can be used to steal system data when an administrator exports it to a CSV file. This could lead to unauthorized access to sensitive information. To protect your system, update to a patched version of Snipe-IT or restrict access to administrative features.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
snipeitapp snipe-it 7.0.13
cpe:2.3:a:snipeitapp:snipe-it:7.0.13:*:*:*:*:*:*:*
Original advisory text
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses th...
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.0 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1236Improper Neutralization of Formula Elements in a CSV File
Timeline
Published12 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-51094 · NVD
CVE-2024-51094 · OSV
Track software like this
Free during beta