CVE-2019-13645 - CVE House
Back to Database
Status published Medium CVE-2019-13645

Firefly III before 4.7.17.3 is vulnerable to stored XSS due...

Vulnerability Description

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-13645

Credits & Attribution

No credits recorded in the NVD database.

References

More from firefly-iii

View All →
CVE-2024-37893
MFA bypass in oauth flow in Firefly III
Medium 5.9
CVE-2023-1789
Improper Input Validation in firefly-iii/firefly-iii
Medium 5.2
CVE-2023-1788
Insufficient Session Expiration in firefly-iii/firefly-iii
Medium 5.4
CVE-2023-0298
Incorrect Authorization in firefly-iii/firefly-iii
Medium 6.5
CVE-2021-4015
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Medium 4.3

Affected Vendor

firefly-iii

View all reports →

Affected Software

firefly iii
Vulnerable Versions:
0

Timeline

Official Publish: July 18th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.