GHSA-hpx4-xjp7-m4vr
Stored cross-site scripting in Snipe-IT
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | snipe/snipe-it | < 5.4.3 | 5.4.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Snipe-IT prior to version 5.4.3 is vulnerable to stored cross-site scripting because the input to the `checked_out_to` parameter is not escaped. The vulnerability is capable of stealing a user's cookie.
References
External links from the advisory. They lead to third-party sites.