PT-2019-13459 · Firefly Iii · Firefly-Iii
Dayn1Ne
·
Publicado
2019-07-18
·
Atualizado
2024-08-05
·
CVE-2019-13644
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Firefly III versions prior to 4.7.17.1
Description
The issue is related to stored XSS due to the lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction and is executed on the "tags/show/$tag number$" tag summary page. An attacker must have the same access rights as the user to execute the vulnerability.
Recommendations
For versions prior to 4.7.17.1, update to version 4.7.17.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the tag summary page or limiting the ability to create transactions with user-supplied data in budget names until the update is applied.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Firefly-Iii