Technical impact
Prior to version 8.6.2, Snipe‑IT stored a manufacturer or supplier name as part of a table component that becomes a data-selected-count-id attribute. On the client side the browser decodes that id, uses it as a selector, and appends a string built from countId.substring(1) to the DOM via jQuery .after(). A crafted name can therefore cause arbitrary JavaScript to run when an authenticated user views a manufacturer or supplier detail page, potentially exposing confidential data or allowing the attacker to perform actions within that session. This flaw is a DOM‑based cross‑site scripting vulnerability (CWE‑79).
Affected Systems
Snipe‑IT, a web‑based IT asset management system, versions prior to 8.6.2 are affected. The product is maintained by grokability.
Risk and Exploitability
The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an authenticated user to visit a manufacturer or supplier detail page; the flaw is client‑side and thus cannot directly compromise the server. Nonetheless, the ability to execute script in the user’s browser poses a risk of session hijacking, data exfiltration, or manipulation of the UI. The likelihood of exploitation is moderate because the attacker must first embed a malicious name via an authenticated interface, but once present, any subsequent visit by an authenticated user will trigger the script.
Github GHSA