VulnerabilityDeferred

CVE-2019-25264

Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript.

MEDIUM 5.1EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags to execute arbitrary JavaScript when the accessory is viewed by other users.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: disclosure@vulncheck.com

References

https://github.com/snipe/snipe-it/releases/tag/v4.7.5
https://snipeitapp.com/
https://www.exploit-db.com/exploits/47756
https://www.vulncheck.com/advisories/snipe-it-open-source-asset-management-persistent-cross-site-scripting

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.