~ / search / GHSA-5hpw-vcj2-prwg

GHSA-5hpw-vcj2-prwg

Firefly III vulnerable to stored XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-13645

Packages

EcosystemPackageAffectedFixed in
Packagist grumpydictator/firefly-iii < 4.7.17.3 4.7.17.3

Details

As written in the advisory (Markdown source, shown as plain text).

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing.

References

External links from the advisory. They lead to third-party sites.