CVE-2022-2514

Cross-site Scripting (XSS) - Reflected in beancount/fava

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Affected

beancount · beancount/fava

CVSS v4.0 GitHub

5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.0 HUNTR

8.0 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

EPSS

0.87% chance of exploitation in the next 30 days, 58th percentile

Published

2022-07-25

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429

Security advisories

• beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711
• advisories/GHSA-xrf4-39fm-j5f2

References

• CVE Record
• NVD entry