Snipe-IT - Host Header Injection
Priority MEDIUM 41CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.
Why it matters now
EPSS 0.01322 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snipe/snipe-it (Packagist): 5.3.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grokability | snipe-it | v3.0-alpha and later; up to v5.3.7 | — | No fix listed | CNA |
| — | snipe/snipe-it (Packagist) | 3.0-alpha to before 5.3.8 | 5.3.8 | Patch available | GHSA-9vh6-qfv6-vcqp |
- snipe-it Vendorgrokability Affected v3.0-alpha and later; up to v5.3.7 Fixed in — No fix listed CNA
- snipe/snipe-it (Packagist) Vendor— Affected 3.0-alpha to before 5.3.8 Fixed in 5.3.8 Patch available GHSA-9vh6-qfv6-vcqp
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* | 3.0.0 – 5.3.7 | Vulnerable | grokability |
| cpe:2.3:a:snipeitapp:snipe-it:3.0.0:alpha1:*:*:*:*:*:* | 3.0.0 alpha1 | Vulnerable | grokability |
| cpe:2.3:a:snipeitapp:snipe-it:3.0.0:alpha2:*:*:*:*:*:* | 3.0.0 alpha2 | Vulnerable | grokability |
| cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta1:*:*:*:*:*:* | 3.0.0 beta1 | Vulnerable | grokability |
| cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta2:*:*:*:*:*:* | 3.0.0 beta2 | Vulnerable | grokability |
| cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta3:*:*:*:*:*:* | 3.0.0 beta3 | Vulnerable | grokability |
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions 3.0.0 – 5.3.7 Vulnerable ·grokability
- cpe:2.3:a:snipeitapp:snipe-it:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·grokability
- cpe:2.3:a:snipeitapp:snipe-it:3.0.0:alpha2:*:*:*:*:*:* Versions 3.0.0 alpha2 Vulnerable ·grokability
- cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·grokability
- cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·grokability
- cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Vulnerable ·grokability
Remediation
- Fix · GHSA-9vh6-qfv6-vcqp snipe/snipe-it (Packagist) Fixed in 5.3.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23064
- 2026-10-03 Alias added: GHSA-9vh6-qfv6-vcqp
References
More grokability Snipe-it vulnerabilities
- TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
- TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
- TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
- TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
- TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
- TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
Sources
- CVE-2022-23064 · CVE Program
- CVE-2022-23064 · NVD
- FIRST EPSS
- GHSA-9vh6-qfv6-vcqp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences