CVE-2022-2514
2 advisories.
PyPI/fava CVE-2022-2514: medium 6.1, EPSS 0.87%
Fava time and filter parameters vulnerable to reflected Cross-site Scripting
Action: Upgrade fava to 1.22 or later.
pip install fava==1.22Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.22 | - |
Fixed versions
| 1.22 |
Sources
- osv: GHSA-xrf4-39fm-j5f2
- https://nvd.nist.gov/vuln/detail/CVE-2022-2514
- https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711
- https://github.com/advisories/GHSA-xrf4-39fm-j5f2
- https://github.com/beancount/fava
- https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-239.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-43182.yaml
- https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429
CVE-2022-2514 · published · modified · JSON
PyPI/fava CVE-2022-2514: unknown, EPSS 0.87%
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
Action: Upgrade fava to 1.22 or later.
pip install fava==1.22Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.22 | - |
Fixed versions
| 1.22 |
Sources
- osv: PYSEC-2022-239
- https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429
- https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711
- https://github.com/advisories/GHSA-xrf4-39fm-j5f2
CVE-2022-2514 · published · modified · JSON