Fava vulnerable to reflected cross-site scripting

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-2589 · ADVISORY
• beancount/fava commit 68bbb6e · WEB
• GitHub Advisory GHSA-6hcj-qrw3-m66q · ADVISORY
• beancount/fava · PACKAGE
• pypa/advisory-database · WEB
• huntr.dev/bounties/8705800d-cf2f-433d-9c3e-dbef6a3f7e08 · WEB

fava のその他の脆弱性

• CVE-2022-2523中 6.1Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
• CVE-2022-2514中 6.1The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which co…