CVE-2024-48987

6.6

MEDIUMCVSS v3

Published

October 11, 2024

Affected

3 projects

Assigned by

MITRE

Severity scale

010

Description

Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

grokability/snipe-it

GitHubA free open source IT asset/license management system

< 7.0.10NVD

snipeit

Python Package IndexPython library to access the SnipeIT API

< 7.0.10NVD

snipe/snipe-it

Docker Hub

More on this CVE

NVD↗GitHub Advisory↗

The *only* official docker hub repository for Snipe-IT from the maintainers of Snipe-IT.

< 7.0.10NVD

Security Advisories

CVE-2024-48987

Description

More on this CVE