CVE-2022-1445: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

April 24, 2022 (updated May 3, 2022)

Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.

References

github.com/snipe/snipe-it/commit/f623d05d0c3487ae24c4f13907e4709484e5bf41
huntr.dev/bounties/f4420149-5236-4051-a458-5d4f1d5b7abd
nvd.nist.gov/vuln/detail/CVE-2022-1445

Code Behaviors & Features

Detect and mitigate CVE-2022-1445 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →