CVE-2019-14671 - Firefly III 4.7.17.3 is vulnerable to local file enumeration

Back Back to CVE browser

LOW

Firefly III 4.7.17.3 is vulnerable to local file enumeration

Published Aug 5, 2019

3.3

LOW

CVSS 3.0

EPSS 0.47%

Description

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (4)

https://github.com/advisories/GHSA-jjcx-999m-35hc
Advisory
https://github.com/firefly-iii/firefly-iii/commit/e80d616ef4397e6e764f6b7b7a5b30121244933c
x_refsource_MISCPatchThird Party Advisory
https://github.com/firefly-iii/firefly-iii/issues/2367
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14671

Link	Providers	Tags
https://github.com/advisories/GHSA-jjcx-999m-35hc		Advisory
https://github.com/firefly-iii/firefly-iii/commit/e80d616ef4397e6e764f6b7b7a5b30121244933c		x_refsource_MISCPatchThird Party Advisory
https://github.com/firefly-iii/firefly-iii/issues/2367		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14671