9.8

CVE-2023-1789

Improper Input Validation in firefly-iii/firefly-iii

Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Firefly-iii ≫ Firefly Iii Version < 5.7.18
Firefly-iii ≫ Firefly Iii Version 5.8.0 Update alpha1
Firefly-iii ≫ Firefly Iii Version 6.0.0 Update alpha1
Firefly-iii ≫ Firefly Iii Version 6.0.0 Update alpha2
Firefly-iii ≫ Firefly Iii Version 6.0.0 Update beta1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.251
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@huntr.dev 5.2 1.1 3.7
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/firefly-iii/firefly-iii/commit/6b05c0fbd3e8c40ae9b24dc2698821786fccf0c5
Patch
https://huntr.dev/bounties/2c3489f7-6b84-48f8-9368-9cea67cf373d
Permissions Required