GHSA-jjcx-999m-35hcLowCVSS 3.3

Improper Input Validation in Firefly III

Published
September 8, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-14671 →

📋 Description

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.

🎯 Affected products1

  • composer/grumpydictator/firefly-iii:<= 4.7.17.3

🔗 References (4)