GitHub Advisoryadvisory · Packagist

GHSA-jjcx-999m-35hc Improper Input Validation in Firefly III

LOW Published 2021-09-08 Modified 2021-07-22 Official page ↗
Aliases
CVE-2019-14671
Ecosystem
Packagist
Packages
grumpydictator/firefly-iii
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-20
Reviewed
2021-07-22

Affected packages

• Packagist grumpydictator/firefly-iii: < 4.7.17.4 → fixed in 4.7.17.4

Description

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.

Related

Alias · CVE (1)

  • CVE-2019-14671 Firefly III 4.7.17.3 is vulnerable to local file enumeration. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References