GHSA-q8hg-3vqv-f8v3MediumCVSS 6.1

Fava vulnerable to Reflected Cross-site Scripting

Published
July 26, 2022
Last Modified
September 20, 2024

🔗 CVE IDs covered (1)

CVE-2022-2523 →

📋 Description

Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2. The query_string parameter of Fava is vulnerable to reflected cross-site scripting, for which a attacker can modify any information that the user is able to modify. This issue is fixed in version 1.22.2.

🎯 Affected products1

  • pip/fava:>= 0, < 1.22.2

🔗 References (5)