Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2022-0622: Snipe‑IT may expose private data in error messages
CVE-2022-0622 · published 4 years ago
Summary
The Snipe‑IT asset management system (versions before 5.3.11) can show sensitive information when an error occurs. This could allow users to see details they shouldn’t, such as configuration or credential data. Upgrade to version 5.3.11 or later to stop the detailed error messages from being displayed.
What to do
- Update snipe snipe-it to version 5.3.11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | snipe | snipe-it |
< 5.3.11 Fix: upgrade to 5.3.11
|
| – | snipeitapp | snipe-it |
<= 5.3.10 6.0.0 cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Original advisory text
Generation of Error Message Containing Sensitive Information in snipe/snipe-it
Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.
References
- https://github.com/advisories/GHSA-pwwm-pwx2-2hw7
- https://huntr.dev/bounties/4ed99dab-5319-4b6b-919a-84a9acd0061a URL
- https://nvd.nist.gov/vuln/detail/CVE-2022-0622 Vendor Advisory
- https://github.com/snipe/snipe-it/commit/178e44095141ab805c282f563fb088df1a10b2e... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0622.j... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-209Generation of Error Message Containing Sensitive Information
Timeline
Published17 Feb 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta