CVE-2024-48987
Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from …
Published: 2024-10-11 · CVSS: 6.6 · CVSS 3.1
Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7