Stored XSS Vulnerability in Firefly III Wallet Application
CVE-2019-14667

6.1MEDIUM

Key Information:

Vendor

Firefly-iii

Status
Firefly Iii
Vendor
CVE Published:
5 August 2019

What is CVE-2019-14667?

Firefly III version 4.7.17.4 is impacted by multiple stored XSS vulnerabilities due to inadequate filtration of user-input data within critical fields, such as the transaction description and asset account name. This allows malicious JavaScript to execute during transactions, potentially compromising sensitive user information. It is crucial to implement proper input sanitization measures to mitigate this risk and protect users.

References

https://github.com/firefly-iii/firefly-iii/issues/2363
x_refsource_MISC
https://github.com/firefly-iii/firefly-iii/commit/427de05...
x_refsource_MISC
https://github.com/firefly-iii/firefly-iii/commit/15d4d18...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.