Platform
php
Component
snipe/snipe-it
Fixed in
v5.4.3
CVE-2022-1380 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting Snipe-IT versions up to and including v5.4.3. This vulnerability allows attackers to inject malicious scripts through the Item name parameter, potentially leading to cookie theft and account compromise. The vulnerability was published on April 16, 2022, and a patch is available in version v5.4.3.
The primary impact of CVE-2022-1380 is the potential for attackers to steal user cookies. Successful exploitation allows an attacker to impersonate a legitimate user, gaining unauthorized access to sensitive data and performing actions on behalf of the victim. This could include modifying asset records, accessing financial information, or even gaining administrative control of the Snipe-IT instance. The stored nature of the XSS means that the malicious script persists on the server, potentially affecting multiple users over time. This vulnerability shares similarities with other XSS attacks where cookie theft is a primary goal, enabling session hijacking and further compromise.
CVE-2022-1380 is a publicly known vulnerability with a high CVSS score. Public proof-of-concept exploits are likely to emerge, increasing the risk of exploitation. While no confirmed active exploitation campaigns have been publicly reported as of this writing, the ease of exploitation and the potential impact make it a high-priority vulnerability. The vulnerability was disclosed on April 16, 2022.
Exploit Status
EPSS
0.25% (48% percentile)
CVSS Vector
The primary mitigation for CVE-2022-1380 is to immediately upgrade Snipe-IT to version v5.4.3 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Item name parameter to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Monitor Snipe-IT logs for suspicious activity, particularly unusual script execution or attempts to access sensitive data.
Actualice Snipe-IT a la versión 5.4.3 o superior. Esta versión contiene la corrección para la vulnerabilidad XSS almacenada. Puede descargar la última versión desde el sitio web oficial o el repositorio de GitHub.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2022-1380 is a critical stored XSS vulnerability in Snipe-IT versions up to v5.4.3, allowing attackers to inject malicious scripts through the Item name parameter.
Yes, if you are running Snipe-IT versions prior to v5.4.3, you are vulnerable to this XSS attack. Upgrade immediately.
Upgrade Snipe-IT to version v5.4.3 or later. Implement input validation and sanitization as a temporary workaround if upgrading is not immediately possible.
While no confirmed active exploitation campaigns have been publicly reported, the vulnerability's severity and ease of exploitation suggest a high risk of future attacks.
Refer to the Snipe-IT security advisory on their GitHub repository: https://github.com/snipe/snipe-it/security/advisories/GHSA-5p7g-x49w-999c
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.