Fava time and filter parameters vulnerable to reflected Cross-site Scripting

보통 6.1CVE-2022-2514 · GHSA-xrf4-39fm-j5f2 · PYSEC-2022-239 · Published 25/07/2022 · updated 17/06/2026

요약

CVE-2022-2514은(는) fava, fava (fava project)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.87%, 전체 취약점의 59.1%보다 높음.
조치: 1.22 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
fava PyPI	`< 1.22`	`1.22`
fava fava_project	`< 1.22`	`1.22`

Description

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected cross-site scripting due to the lack of escaping of error messages which contained the parameters in verbatim.

NVD description

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

References

nvd.nist.gov/vuln/detail/CVE-2022-2514 · ADVISORY
beancount/fava commit ca9e388 · WEB
GitHub Advisory GHSA-xrf4-39fm-j5f2 · ADVISORY
beancount/fava · PACKAGE
pypa/advisory-database · WEB
pypa/advisory-database · WEB
huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429 · WEB

fava의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

fava

PyPI

< 1.22

1.22

fava

fava_project

< 1.22

1.22

Description

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected cross-site scripting due to the lack of escaping of error messages which contained the parameters in verbatim.

NVD description

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.