// For flags

CVE-2019-14667

 

Severity Score

6.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.

Firefly III 4.7.17.4, es vulnerable a múltiples problemas de XSS almacenado debido a la falta de filtración de datos suministrados por el usuario en el campo de descripción de transacción y el nombre de cuenta del activo. El código JavaScript es ejecutado durante una acción de transacción de conversión.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-08-05 CVE Reserved
  • 2019-08-05 CVE Published
  • 2024-07-29 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Firefly-iii
Search vendor "Firefly-iii"
 Firefly Iii
Search vendor "Firefly-iii" for product "Firefly Iii"
 4.7.17.4
Search vendor "Firefly-iii" for product "Firefly Iii" and version "4.7.17.4"
-
Affected