PT-2022-17169 · Unknown+1 · Beancount/Fava+1

Yagebu · Published 2022-07-25 · Updated 2022-07-27 · CVE-2022-2523

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions beancount/fava versions prior to 1.22.2

Description The issue concerns a Cross-site Scripting (XSS) - Reflected vulnerability. The query string parameter of Fava is vulnerable to reflected cross-site scripting, allowing an attacker to modify any information that the user is able to modify.

Recommendations For versions prior to 1.22.2, update to version 1.22.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the query string parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-2523

GHSA-Q8HG-3VQV-F8V3

PYSEC-2022-240

Affected Products

Debian

Beancount/Fava

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2523.json · Exploit
• 🔥 https://huntr.dev/bounties/2a1802d8-1c2e-4919-96a7-d4dcf7ffcf8f · Exploit
• https://github.com/beancount/fava/commit/dccfb6a2f4567f35ce2e9a78e24f92ebf946bc9b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2523 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2523 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2523 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2523 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2523 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-240 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-2523 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2523 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8hg-3vqv-f8v3 · Vendor Advisory
• https://github.com/beancount/fava · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-240.yaml · Note
• https://github.com/advisories/GHSA-q8hg-3vqv-f8v3 · Note