CVE-2022-44380: 
PHP vulnerability analysis and mitigation

Snipe-IT before version 6.0.14 was identified with a Cross-Site Scripting (XSS) vulnerability (CVE-2022-44380) affecting the View Assigned Assets functionality. The vulnerability was discovered by Charalampos Maraziaris and disclosed on December 23, 2022 (Census Labs).

The vulnerability exists in the 'Account' drop-down menu on the top-right of the app's UI, specifically when users select the 'View Assigned Assets' option. The issue stems from improper content rendering in the account/view-assets view (/resources/views/account/view-assets.blade.php) where the title is drawn from the database without proper HTML entity escaping in the Laravel Blade framework, using {!! ... !!} instead of {{ ... }} (Census Labs).

An attacker could inject malicious JavaScript code into the Accessory and Consumable name fields, which would then be executed in a visitor's browser. By targeting a Super User, an authenticated adversary could achieve privilege escalation, granting themselves Super User status (Census Labs).

The vulnerability was patched in Snipe-IT version 6.0.14. Organizations are strongly recommended to upgrade to this version or later to address the XSS vulnerability (Census Labs).