What is GHSA-p885-prv3-m4xv?

GHSA-p885-prv3-m4xv is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in snipe-it

Which CVE IDs does GHSA-p885-prv3-m4xv cover?

GHSA-p885-prv3-m4xv covers the following CVE IDs: CVE-2022-1380. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p885-prv3-m4xv?

GHSA-p885-prv3-m4xv has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-p885-prv3-m4xv?

GHSA-p885-prv3-m4xv affects 1 product, including: composer/snipe/snipe-it:\u003c 5.4.3.

GHSA-p885-prv3-m4xvMediumCVSS 5.4

Cross-site Scripting in snipe-it

Vendor

GitHub Security Advisories

Published

April 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-1380 →

📋 Description

Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

🎯 Affected products1

composer/snipe/snipe-it:< 5.4.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-1380
https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9
https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12
https://github.com/advisories/GHSA-p885-prv3-m4xv