by Kastro
Paper/Archive/CVE-2022-1380

CVE-2022-1380

snipe snipe/snipe-it — Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 58.1.581 × 2011.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

Affected

ProductAffectedFixed inSource
snipe/snipe-itunspecified – < v5.4.3v5.4.3CNA

Scores by source

@huntrdev (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refhuntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12refgithub.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9