CVE-2024-48987

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1393

Affected software

No affected versions have been published.

Timeline

Published: Oct 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-489887.6SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to CVE-2024-489897.5A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial CVE-2024-48995.0The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users suc CVE-2024-489907.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart int CVE-2024-489917.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition CVE-2024-489927.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart int CVE-2024-489938.8SQL Server Native Client Remote Code Execution Vulnerability CVE-2024-489948.8SQL Server Native Client Remote Code Execution Vulnerability CVE-2024-489958.8SQL Server Native Client Remote Code Execution Vulnerability CVE-2024-489968.8SQL Server Native Client Remote Code Execution Vulnerability CVE-2024-489978.8SQL Server Native Client Remote Code Execution Vulnerability CVE-2024-489988.8SQL Server Native Client Remote Code Execution Vulnerability