High severityNVD Advisory· Published Oct 11, 2024· Updated Mar 25, 2025
CVE-2024-48987
CVE-2024-48987
Description
Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
snipe/snipe-itPackagist | < 7.0.10 | 7.0.10 |
Affected products
2- Snipe-IT/Snipe-ITdescription
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-57qh-vmjr-5jxgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-48987ghsaADVISORY
- github.com/snipe/snipe-it/releases/tag/v7.0.10ghsaWEB
- snipe-it.readme.io/docs/key-rotationghsaWEB
- www.synacktiv.com/advisories/snipe-it-unauthenticated-remote-command-execution-when-appkey-knownghsaWEB
News mentions
0No linked articles in our index yet.