{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-22T19:24:17.743","vulnerabilities":[{"cve":{"id":"CVE-2022-23064","sourceIdentifier":"vulnerabilitylab@mend.io","published":"2022-05-02T13:15:08.170","lastModified":"2026-06-17T04:29:26.677","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over."},{"lang":"es","value":"En Snipe-IT, versiones v3.0-alpha a v5.3.7, son vulnerables a una Inyección de Encabezado de Host. Al enviar un encabezado de host especialmente diseñado en la petición de restablecimiento de la contraseña, es posible enviar enlaces de restablecimiento de la contraseña a usuarios que, una vez que se hace clic, conllevan a un servidor controlado por el atacante y, por lo tanto, a un filtrado del token de restablecimiento de la contraseña. Esto conlleva a una toma de la cuenta"}],"affected":[{"source":"vulnerabilitylab@mend.io","affectedData":[{"vendor":"snipe","product":"snipe-it","versions":[{"version":"v3.0-alpha","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"unspecified","lessThanOrEqual":"v5.3.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"vulnerabilitylab@mend.io","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"vulnerabilitylab@mend.io","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndIncluding":"5.3.7","matchCriteriaId":"B8320AAA-B17E-4CBD-8FB4-6017A43AC818"},{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:3.0.0:alpha1:*:*:*:*:*:*","matchCriteriaId":"00A46F6A-D21C-49CE-9B0E-2BE8720667BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:3.0.0:alpha2:*:*:*:*:*:*","matchCriteriaId":"15C80E6E-4F9A-4EC6-B164-3C68EAF4D2F2"},{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"AC900331-28F7-450D-B737-0CC245748AC7"},{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"5C923065-E4E2-4200-920E-BE476CDF14CF"},{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:3.0.0:beta3:*:*:*:*:*:*","matchCriteriaId":"EA637261-B87C-4759-A89F-368CA203AF0E"}]}]}],"references":[{"url":"https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc","source":"vulnerabilitylab@mend.io","tags":["Patch","Third Party Advisory"]},{"url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23064","source":"vulnerabilitylab@mend.io","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23064","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}