CVE-2025-63601

概要

参考情報

• dappsec.substack.com/p/snipe-it-post-authenticated-remote
• fptcloud.com/en/cve-2025-63601-proof-of-concept
• grokability/snipe-it#17966 · Issue Tracking
• grokability/snipe-it release v8.3.3 · Release Notes

snipe-it のその他の脆弱性

• CVE-2026-116201高 8.8Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-…
• CVE-2026-116200中 5.9Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP…
• CVE-2026-116199高 8.1Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username…
• CVE-2026-116198中 4.3Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagge…
• CVE-2026-63498中 5.4Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{fil…