Firefly III vulnerable to reflected cross-site scripting

MEDIO 5.4CVE-2019-13646 · GHSA-mrc2-h7q2-pp97 · Published 18/07/2019 · updated 17/06/2026

In breve

CVE-2019-13646 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda grumpydictator/firefly-iii, firefly iii (firefly-iii).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.76%, superiore al 55.4% delle vulnerabilità.
Correzione: aggiornare a 4.7.17.3 o successiva.

Package	Affected versions	Patched versions
grumpydictator/firefly-iii Packagist	`< 4.7.17.3`	`4.7.17.3`
firefly iii firefly-iii	`< 4.7.17.3`	`4.7.17.3`

Description

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.

NVD description

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

References

nvd.nist.gov/vuln/detail/CVE-2019-13646 · ADVISORY
firefly-iii/firefly-iii · WEB
firefly-iii/firefly-iii commit f795cb0 · WEB
firefly-iii/firefly-iii · PACKAGE
firefly-iii/firefly-iii · WEB

Altre vulnerabilità di grumpydictator/firefly-iii

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

grumpydictator/firefly-iii

Packagist

< 4.7.17.3

4.7.17.3

firefly iii

firefly-iii

< 4.7.17.3

4.7.17.3

Description

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.

NVD description

Altre vulnerabilità di grumpydictator/firefly-iii

Vedi tutto →