GHSA-hpx4-xjp7-m4vrMediumCVSS 5.4

Stored cross-site scripting in Snipe-IT

Published
April 25, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-1445 →

📋 Description

Snipe-IT prior to version 5.4.3 is vulnerable to stored cross-site scripting because the input to the checked_out_to parameter is not escaped. The vulnerability is capable of stealing a user's cookie.

🎯 Affected products1

  • composer/snipe/snipe-it:< 5.4.3

🔗 References (4)