CVE-2019-13646 - Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query

Back Back to CVE browser

MEDIUM

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query

Published Jul 18, 2019

5.4

MEDIUM

CVSS 3.0

EPSS 0.76%

Description

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://github.com/advisories/GHSA-mrc2-h7q2-pp97
Advisory
https://github.com/firefly-iii/firefly-iii/commit/f795cb07e1bb9ad3bd0dceeafbb0ece4ebe518d7
https://github.com/firefly-iii/firefly-iii/compare/a70b7cc...7d482aa
x_refsource_MISCPatchThird Party Advisory
https://github.com/firefly-iii/firefly-iii/issues/2339
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-13646

Link	Providers	Tags
https://github.com/advisories/GHSA-mrc2-h7q2-pp97		Advisory
https://github.com/firefly-iii/firefly-iii/commit/f795cb07e1bb9ad3bd0dceeafbb0ece4ebe518d7
https://github.com/firefly-iii/firefly-iii/compare/a70b7cc...7d482aa		x_refsource_MISCPatchThird Party Advisory
https://github.com/firefly-iii/firefly-iii/issues/2339		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-13646