Snipe-IT vulnerable to Improper Authentication
Date: 2022-09
Affected: composer/snipe/snipe-it
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2022-3173
CWE: CWE-287
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the `View and Modify License Files` permission may access files uploaded to licenses as long as they have the `View` permission for licenses.


Mitigations:

Architectural layers (MAESTRO):