CVE-2022-1380: Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-16 · updated 2026-06-17
Weakness: CWE-79

Description

Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

Affected products

grokability snipe-it: before 5.4.3 — fixed in 5.4.3

How to fix

Upgrade to a fixed version: grokability snipe-it 5.4.3. Check the vendor advisory for mitigations.

References

https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9
https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12
https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9
https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12

Get alerted when CVE-2022-1380 or the next vulnerability affects your stack