CVE-2024-51094
Published Nov 12, 2024
Last updated 4 days ago
Overview
- Description
- An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.
- Source
- cve@mitre.org
- NVD status
- Awaiting Analysis
Social media
- Hype score
- Not currently trending