CVE-2022-1445: Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-24 · updated 2026-06-17
Weakness: CWE-79

Description

Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.

Affected products

grokability snipe-it: before 5.4.3 — fixed in 5.4.3

How to fix

Upgrade to a fixed version: grokability snipe-it 5.4.3. Check the vendor advisory for mitigations.

References

https://github.com/snipe/snipe-it/commit/f623d05d0c3487ae24c4f13907e4709484e5bf41
https://huntr.dev/bounties/f4420149-5236-4051-a458-5d4f1d5b7abd
https://github.com/snipe/snipe-it/commit/f623d05d0c3487ae24c4f13907e4709484e5bf41
https://huntr.dev/bounties/f4420149-5236-4051-a458-5d4f1d5b7abd

Get alerted when CVE-2022-1445 or the next vulnerability affects your stack