PT-2022-13895 · Snipe-It · Snipe-It

Published 2022-04-24 · Updated 2022-05-03 · CVE-2022-1445

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions snipe-it versions prior to 5.4.3

Description The issue is related to a Stored Cross Site Scripting vulnerability in the checked out to parameter. This vulnerability can lead to the theft of a user's cookie. The input to the checked out to parameter is not properly escaped, allowing for the execution of malicious scripts.

Recommendations For versions prior to 5.4.3, update to version 5.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the checked out to parameter to minimize the risk of exploitation. Avoid using the checked out to parameter in sensitive operations until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1445

GHSA-HPX4-XJP7-M4VR

Affected Products

Snipe-It

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1445.json · Exploit
• 🔥 https://huntr.dev/bounties/f4420149-5236-4051-a458-5d4f1d5b7abd · Exploit
• https://github.com/snipe/snipe-it/commit/f623d05d0c3487ae24c4f13907e4709484e5bf41 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1445 · Security Note
• https://osv.dev/vulnerability/GHSA-hpx4-xjp7-m4vr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1445 · Vendor Advisory
• https://github.com/snipe/snipe-it · Note
• https://t.me/cibsecurity/41366 · Telegram Post