CVE-2026-62368

Katalog CVE

CVSS 8.4 · High EPSS 0,35%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada snipeitapp snipe-it. Skor CVSS 3.1 8.4 (High) menurut NVD.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.

Rincian

Terbit di NVD

24 September 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

8.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539 exploit · patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8 patch
• https://github.com/grokability/snipe-it/releases/tag/v8.7.0 release notes