CVE-2022-2514CWE-79

Cross-site Scripting (XSS) - Reflected in beancount/fava

High · published July 25, 2022

CVSS v3.0
8.0
EPSS
1%
Percentile
58.5
In the wild
Unconfirmed
What it is

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

The record
Technical detail
CVSS v3.0
8.0 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00874 · 58.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-07-25T13:42Z
EPSS history
Timeline
  • 25 JUL 13:42Z
    Cross-site Scripting (XSS) - Reflected in beancount/fava
    cvelistv5