Lucene search

MitreCVE-2019-14672

HistoryAug 05, 2019 - 8:15 p.m.

CVE-2019-14672

2019-08-0520:15:12

CWE-79

mitre

web.nvd.nist.gov

firefly iii

4.7.17.5

stored xss

vulnerability

liability name

javascript

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.

Affected configurations

Nvd

Node

firefly-iiifirefly_iiiMatch4.7.17.5

VendorProductVersionCPE
firefly-iiifirefly_iii4.7.17.5cpe:2.3:a:firefly-iii:firefly_iii:4.7.17.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
firefly-iii	firefly_iii	4.7.17.5	cpe:2.3:a:firefly-iii:firefly_iii:4.7.17.5:::::::*

References

github.com/firefly-iii/firefly-iii/commit/8717f469b10e9f7e1547c6f70f7d24e1359d28d4

github.com/firefly-iii/firefly-iii/issues/2370

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Related for CVE-2019-14672