CVE-2023-5452 (PHP, published 2023-10-06T20:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Transformers/ActionlogsTransformer.php
Commit message: Escaping asset history old/new values

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
            $clean_meta['rtd_location_id']['old'] = $clean_meta['rtd_location_id']['old'] ? "[id: ".$clean_meta['rtd_location_id']['old']."] ". $location->find($clean_meta['rtd_location_id']['old'])->name : trans('general.unassigned');
            $clean_meta['rtd_location_id']['new'] = $clean_meta['rtd_location_id']['new'] ? "[id: ".$clean_meta['rtd_location_id']['new']."] ". $location->find($clean_meta['rtd_location_id']['new'])->name : trans('general.unassigned');
        if(array_key_exists('location_id', $clean_meta)) {
            $clean_meta['location_id']['old'] = $clean_meta['location_id']['old'] ? "[id: ".$clean_meta['location_id']['old']."] ".$location->find($clean_meta['location_id']['old'])->name : trans('general.unassigned');
            $clean_meta['location_id']['new'] = $clean_meta['location_id']['new'] ? "[id: ".$clean_meta['location_id']['new']."] ".$location->find($clean_meta['location_id']['new'])->name : trans('general.unassigned');
            $oldModelName = $oldModel->name ?? trans('admin/models/message.deleted');
            $newModelName = $newModel->name ?? trans('admin/models/message.deleted');
            $oldCompanyName = $oldCompany->name ?? trans('admin/companies/message.deleted');
            $newCompanyName = $newCompany->name ?? trans('admin/companies/message.deleted');
            $oldSupplierName = $oldSupplier->name ?? trans('admin/suppliers/message.deleted');
            $newSupplierName = $newSupplier->name ?? trans('admin/suppliers/message.deleted');

Fixed code:
            $clean_meta['rtd_location_id']['old'] = $clean_meta['rtd_location_id']['old'] ? "[id: ".$clean_meta['rtd_location_id']['old']."] ". e($location->find($clean_meta['rtd_location_id']['old'])->name) : trans('general.unassigned');
            $clean_meta['rtd_location_id']['new'] = $clean_meta['rtd_location_id']['new'] ? "[id: ".$clean_meta['rtd_location_id']['new']."] ". e($location->find($clean_meta['rtd_location_id']['new'])->name) : trans('general.unassigned');

        if (array_key_exists('location_id', $clean_meta)) {
            $clean_meta['location_id']['old'] = $clean_meta['location_id']['old'] ? "[id: ".$clean_meta['location_id']['old']."] ".e($location->find($clean_meta['location_id']['old'])->name): trans('general.unassigned');
            $clean_meta['location_id']['new'] = $clean_meta['location_id']['new'] ? "[id: ".$clean_meta['location_id']['new']."] ".e($location->find($clean_meta['location_id']['new'])->name) : trans('general.unassigned');

            $oldModelName = $oldModel ? e($oldModel->name) : trans('admin/models/message.deleted');
            $newModelName = $newModel ? e($newModel->name) : trans('admin/models/message.deleted');
            $oldCompanyName = $oldCompany ? e($oldCompany->name) : trans('admin/company/message.deleted');
            $newCompanyName = $newCompany ? e($newCompany->name) : trans('admin/company/message.deleted');
            $oldSupplierName = $oldSupplier ? e($oldSupplier->name) : trans('admin/suppliers/message.deleted');
            $newSupplierName = $newSupplier ? e($newSupplier->name) : trans('admin/suppliers/message.deleted');