CyberRota Analysis
AI-GeneratedThe vulnerability affects Snipe-IT versions prior to 8.6.2, allowing an attacker to inject malicious JavaScript through manipulated manufacturer or supplier names, which can execute when an authenticated user views the respective detail pages. This could lead to unauthorized access to session data or actions, posing a risk to user accounts and sensitive information. Organizations using Snipe-IT should prioritize updating to version 8.6.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.