HIGHCVSS 8.8EPSS 1.3%

CVE-2022-23064

snipe-IT vulnerable to host header injection

Published: 2022-05-03
Modified: 2026-09-24
EPSS percentile: 70%
Aliases: GHSA-9vh6-qfv6-vcqp
Sources: github-advisory

Summary

Snipe-IT is a free, open-source IT asset/license management systemIn Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This can lead to account take over.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Packagist	snipe/snipe-it	—	5.3.8

Remediation: Upgrade to 5.3.8 or later.

References

https://github.com/advisories/GHSA-9vh6-qfv6-vcqp

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.