What is GHSA-6hcj-qrw3-m66q?

GHSA-6hcj-qrw3-m66q is a security advisory published by GitHub Security Advisories with Medium severity. Fava vulnerable to reflected cross-site scripting

Which CVE IDs does GHSA-6hcj-qrw3-m66q cover?

GHSA-6hcj-qrw3-m66q covers the following CVE IDs: CVE-2022-2589. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6hcj-qrw3-m66q?

GHSA-6hcj-qrw3-m66q has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-6hcj-qrw3-m66q?

GHSA-6hcj-qrw3-m66q affects 1 product, including: pip/fava:\u003e= 0, \u003c 1.22.3.

GHSA-6hcj-qrw3-m66qMediumCVSS 6.1

Fava vulnerable to reflected cross-site scripting

Vendor

GitHub Security Advisories

Published

August 2, 2022

Last Modified

September 20, 2024

🔗 CVE IDs covered (1)

CVE-2022-2589 →

📋 Description

Fava before 1.22.3 is vulnerable to reflected cross-site scripting due to improper validation on filter conversion.

🎯 Affected products1

pip/fava:>= 0, < 1.22.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-2589
https://github.com/beancount/fava/commit/68bbb6e39319deb35ab9f18d0b6aa9fa70472539
https://huntr.dev/bounties/8705800d-cf2f-433d-9c3e-dbef6a3f7e08
https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-246.yaml
https://github.com/advisories/GHSA-6hcj-qrw3-m66q