Lucene search
PRIOn knowledge basePRION:CVE-2022-23064HistoryMay 02, 2022 - 1:15 p.m.
Design/Logic Flaw
2022-05-0213:15:00
PRIOn knowledge base
www.prio-n.com
1
In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.
| CPE | Name | Operator | Version |
|---|---|---|---|
| snipe-it | ge | 3.0.0 | |
| snipe-it | le | 5.3.7 | |
| snipe-it | eq | 3.0.0 alpha1 | |
| snipe-it | eq | 3.0.0 alpha2 | |
| snipe-it | eq | 3.0.0 beta1 | |
| snipe-it | eq | 3.0.0 beta2 | |
| snipe-it | eq | 3.0.0 beta3 |
Related
nvd
nvd
CVE-2022-23064
2022-05-02 13:15:08
cve
cve
CVE-2022-23064
2022-05-02 13:15:08
osv
osv
CVE-2022-23064
2022-05-02 13:15:08
snipe-IT vulnerable to host header injection
2022-05-03 00:00:43
github
github
snipe-IT vulnerable to host header injection
2022-05-03 00:00:43
cvelist
cvelist
CVE-2022-23064 Snipe-IT - Host Header Injection
2022-05-01 00:00:00
veracode
veracode
Host Header Injection
2022-05-05 02:11:10
Host Header Injection
2022-05-04 15:26:06