Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Snipe-IT - Host Header Injection
Vulnerability Description
In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Vulnerability Title
Snipe-IT 注入漏洞
Vulnerability Description
Snipe-IT是一套开源IT资产/许可证管理系统。 Snipe-IT v3.0-alpha至v5.3.7版本存在注入漏洞。该漏洞源于在重置密码请求中发送一个特别制作的请求头，可以向用户发送密码重置链接，从而导致密码重置令牌泄漏。
CVSS Information
N/A
Vulnerability Type
N/A