Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2022-1380: Snipe‑IT lets attackers steal cookies via item name
CVE-2022-1380 · published 4 years ago
Summary
A text field for item names in Snipe‑IT can store malicious code that runs in a user's browser. When visited, the code can capture the user's login cookie and send it to an attacker. Upgrade to version 5.4.3 or later, or apply input‑filtering patches, to stop this behavior.
What to do
- Update snipe snipe-it to version 5.4.3.
- Update snipeitapp snipe-it to version 5.4.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | snipe | snipe-it |
< 5.4.3 Fix: upgrade to 5.4.3
|
| – | snipeitapp | snipe-it |
< 5.4.3 cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Original advisory text
Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it
Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
References
- https://github.com/advisories/GHSA-p885-prv3-m4xv
- https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1380.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-1380 Vendor Advisory
- https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
9.1
Critical
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Apr 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta