PT-2019-13769 · Firefly Iii · Firefly-Iii

Published 2019-08-05 · Updated 2020-12-16 · CVE-2019-14667

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefly III version 4.7.17.4

Description The issue arises from the lack of filtration of user-supplied data in the transaction description field and the asset account name. This allows for stored XSS issues, where JavaScript code is executed during a convert transaction action.

Recommendations For Firefly III version 4.7.17.4, consider disabling the convert transaction action until a patch is available to prevent the execution of malicious JavaScript code. Restrict access to the transaction description field and the asset account name to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-14667

Affected Products

Firefly-Iii

References · 5

• 🔥 https://github.com/firefly-iii/firefly-iii/issues/2363 · Exploit
• https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991 · Patch
• https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194 · Patch
• https://osv.dev/vulnerability/CVE-2019-14667 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14667 · Security Note