All vulnerabilities
CVE-2022-23064GHSA-9vh6-qfv6-vcqp

snipe/snipe-it: snipe-IT vulnerable to host header injection

snipe snipe/snipe-itcomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.32%Chance of exploitation activity in the next 30 days, higher than 70% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.3.8Fixed versionGitHub
Published2 May 2022Updated 24 Sep 2026CVE List

What fixes it

  • 5.3.8snipe/snipe-it, composerGitHubcomposer require "snipe/snipe-it:^5.3.8"
  • 5.3.8snipe/snipe-it, PackagistOSVcomposer require "snipe/snipe-it:^5.3.8"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Snipe-IT is a free, open-source IT asset/license management systemIn Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This can lead to account take over.

Text from CVE List

Affected versions 54

  • snipe/snipe-it, composer>= 3.0-alpha, <= 5.3.7GitHub
  • snipe-itaffected: v3.0-alpha before unspecifiedCVE List
  • snipe-itaffected: unspecified through v5.3.7CVE List
  • snipe/snipe-it, Packagistfrom 3.0-alpha, fixed in 5.3.8OSV
  • snipe/snipe-it, Packagist3.2.0OSV
  • snipe/snipe-it, Packagistv3.0OSV
  • snipe/snipe-it, Packagistv3.0-alphaOSV
  • snipe/snipe-it, Packagistv3.0-alpha2OSV
  • snipe/snipe-it, Packagistv3.0-beta.1OSV
  • snipe/snipe-it, Packagistv3.0-beta.2OSV
  • snipe/snipe-it, Packagistv3.0-beta.3OSV
  • snipe/snipe-it, Packagistv3.0.0-betaOSV
  • snipe/snipe-it, Packagistv3.1.0OSV
  • snipe/snipe-it, Packagistv3.3.0OSV
  • snipe/snipe-it, Packagistv3.3.0-betaOSV
  • snipe/snipe-it, Packagistv3.4OSV
  • snipe/snipe-it, Packagistv3.4.0-alphaOSV
  • snipe/snipe-it, Packagistv3.4.0-betaOSV
  • snipe/snipe-it, Packagistv3.5.0OSV
  • snipe/snipe-it, Packagistv3.5.0-betaOSV
  • snipe/snipe-it, Packagistv3.5.0-beta2OSV
  • snipe/snipe-it, Packagistv3.5.1OSV
  • snipe/snipe-it, Packagistv3.5.2OSV
  • snipe/snipe-it, Packagistv3.6.0OSV
  • snipe/snipe-it, Packagistv3.6.1OSV
  • snipe/snipe-it, Packagistv3.6.2OSV
  • snipe/snipe-it, Packagistv3.6.3OSV
  • snipe/snipe-it, Packagistv3.6.4OSV
  • snipe/snipe-it, Packagistv3.6.5OSV
  • snipe/snipe-it, Packagistv3.6.6OSV
  • snipe/snipe-it, Packagistv4-beta3OSV
  • snipe/snipe-it, Packagistv4-beta4OSV
  • snipe/snipe-it, Packagistv4.0OSV
  • snipe/snipe-it, Packagistv4.0-alphaOSV
  • snipe/snipe-it, Packagistv4.0-alpha-2OSV
  • snipe/snipe-it, Packagistv4.0-betaOSV
  • snipe/snipe-it, Packagistv4.0-beta2OSV
  • snipe/snipe-it, Packagistv4.0-beta5OSV
  • snipe/snipe-it, Packagistv4.0-beta6OSV
  • snipe/snipe-it, Packagistv4.0.1OSV
  • snipe/snipe-it, Packagistv4.0.10OSV
  • snipe/snipe-it, Packagistv4.0.11OSV
  • snipe/snipe-it, Packagistv4.0.12OSV
  • snipe/snipe-it, Packagistv4.0.13OSV
  • snipe/snipe-it, Packagistv4.0.14OSV
  • snipe/snipe-it, Packagistv4.0.15OSV
  • snipe/snipe-it, Packagistv4.0.2OSV
  • snipe/snipe-it, Packagistv4.0.3OSV
  • snipe/snipe-it, Packagistv4.0.4OSV
  • snipe/snipe-it, Packagistv4.0.5OSV
  • snipe/snipe-it, Packagistv4.0.6OSV
  • snipe/snipe-it, Packagistv4.0.7OSV
  • snipe/snipe-it, Packagistv4.0.8OSV
  • snipe/snipe-it, Packagistv4.0.9OSV

References 4