Technical impact
Snipe-IT prior to version 8.6.3 fails to check the return value of ldap_start_tls() in the connectToLdap() method, which permits an on‑path attacker to force the LDAP server to downgrade a TLS session. When the attacker answers the StartTLS request with a protocol error, the connection proceeds in cleartext, allowing the attacker to capture service‑account credentials as well as end‑user login passwords. This vulnerability is a confidentiality breach classified as CWE‑319, an insecure direct channel.
Affected Systems
The affected vendor is grokability, product Snipe‑IT. Any installation older than version 8.6.3 is vulnerable. No precise sub‑version information is available, so all releases before 8.6.3 should be considered at risk.
Risk and Exploitability
The CVSS score of 8.2 indicates that this flaw is high severity. EPSS data are not available, but the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an on‑path attacker who can intercept LDAP traffic and respond to a StartTLS request. The likely attack vector is a man‑in‑the‑middle or compromised network intermediary. Because the flaw does not depend on privileged access or special configuration, the exploitation probability remains moderate to high for exposed LDAP services.
