CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it
Attackers can inject malicious scripts into item names to steal user cookies, potentially leading to account takeover in Snipe-IT.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1380?
CVE-2022-1380 is a critical cross-site scripting vulnerability in Snipeitapp Snipe-It, published on 16 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
Weakness: CWE-79
Which versions are affected by CVE-2022-1380?
2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
snipe/snipe-it Packagist | All versions | 5.4.3 |
snipe/snipe-it Packagist | All versions | 5.4.3 |
Products include Snipeitapp Snipe-It.
How do I fix CVE-2022-1380?
Upgrade snipe/snipe-it to 5.4.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-1380 being exploited?
There is no known exploitation of CVE-2022-1380 in the wild and no public exploit code.
Other vulnerabilities in Snipeitapp Snipe-It
- CVE-2025-63601 File upload in n/a
- CVE-2026-37709 Snipe-IT has insecure permissions in file uploads
- CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS
- CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- CVE-2022-1445 Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it
Sources
Also known as GHSA-p885-prv3-m4xv.