CVE-2022-23064 Snipe-IT - Host Header Injection
Attackers can exploit Host Header Injection in password reset flows to leak tokens and take over user accounts in Snipe-IT.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-23064?
CVE-2022-23064 is a high-severity vulnerability in Snipeitapp Snipe-It, published on 2 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.
Weakness: CWE-74
Which versions are affected by CVE-2022-23064?
2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
snipe/snipe-it Packagist | From 3.0-alpha | 5.3.8 |
snipe/snipe-it Packagist | From 3.0-alpha | 5.3.8 |
Products include Snipeitapp Snipe-It.
How do I fix CVE-2022-23064?
Upgrade snipe/snipe-it to 5.3.8 or later.
Is CVE-2022-23064 being exploited?
There is no known exploitation of CVE-2022-23064 in the wild and no public exploit code.
Other vulnerabilities in Snipeitapp Snipe-It
- CVE-2025-63601 File upload in n/a
- CVE-2026-37709 Snipe-IT has insecure permissions in file uploads
- CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS
- CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it
Sources
Also known as GHSA-9vh6-qfv6-vcqp.