« Volver al listado

CVE-2022-23064

Estado: ModificadaAlta (8.8)—

In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Snipeitapp — Snipe-it

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-23064",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "vulnerabilitylab@mend.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerabilitylab@mend.io",
      "affectedData": [
        {
          "vendor": "snipe",
          "product": "snipe-it",
          "versions": [
            {
              "status": "affected",
              "version": "v3.0-alpha",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "v5.3.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-02T13:15:08.170",
  "references": [
    {
      "url": "https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vulnerabilitylab@mend.io"
    },
    {
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23064",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "vulnerabilitylab@mend.io"
    },
    {
      "url": "https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23064",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vulnerabilitylab@mend.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over."
    },
    {
      "lang": "es",
      "value": "En Snipe-IT, versiones v3.0-alpha a v5.3.7, son vulnerables a una Inyección de Encabezado de Host. Al enviar un encabezado de host especialmente diseñado en la petición de restablecimiento de la contraseña, es posible enviar enlaces de restablecimiento de la contraseña a usuarios que, una vez que se hace clic, conllevan a un servidor controlado por el atacante y, por lo tanto, a un filtrado del token de restablecimiento de la contraseña. Esto conlleva a una toma de la cuenta"
    }
  ],
  "lastModified": "2026-06-17T04:29:26.677",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8320AAA-B17E-4CBD-8FB4-6017A43AC818",
              "versionEndIncluding": "5.3.7",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:snipeitapp:snipe-it:3.0.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00A46F6A-D21C-49CE-9B0E-2BE8720667BE"
            },
            {
              "criteria": "cpe:2.3:a:snipeitapp:snipe-it:3.0.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15C80E6E-4F9A-4EC6-B164-3C68EAF4D2F2"
            },
            {
              "criteria": "cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC900331-28F7-450D-B737-0CC245748AC7"
            },
            {
              "criteria": "cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C923065-E4E2-4200-920E-BE476CDF14CF"
            },
            {
              "criteria": "cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA637261-B87C-4759-A89F-368CA203AF0E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerabilitylab@mend.io"
}