CVE-2021-3728

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Affected

firefly-iii · firefly-iii/firefly-iii

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v3.0 HUNTR

6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.50% chance of exploitation in the next 30 days, 42nd percentile

Published

2021-08-23

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://huntr.dev/bounties/dd54c5a1-0d4a-4f02-a111-7ce4ddc67a4d

Security advisories

• advisories/GHSA-xp5q-77mh-6hm2
• firefly-iii/firefly-iii/commit/14cdce113e0eb8090d09066fcd2b5cf03b5ac84e

References

• CVE Record
• NVD entry