Medium · 5.3 CVE-2022-44381 EUVD-2022-7721GHSA-qqv9-gqh5-7h99

Snipe-IT allows attackers to check whether a user account exists

Published Dec 25, 2022 · Updated Apr 15, 2025 · Assigned by mitre

Description

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.

Ecosystem	Package	Affected	Fixed	Record
Packagist	snipe/snipe-it	<= 6.0.14	—	GHSA-qqv9-gqh5-7h99