CVE-2019-13647

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content

published July 18, 2019

CVSS
—
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00762 · 54.9th percentile
Published
2019-07-18T02:17Z
EPSS history
Timeline
  • 18 JUL 02:17Z
    Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content
    cvelistv5