CVE-2023-1789 - OpenCVE

Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Firefly-iii	Firefly Iii

Configuration 1 [-]

OR	cpe:2.3:a:firefly-iii:firefly_iii::::::::
	cpe:2.3:a:firefly-iii:firefly_iii:5.8.0:alpha1::::::
	cpe:2.3:a:firefly-iii:firefly_iii:6.0.0:alpha1::::::
	cpe:2.3:a:firefly-iii:firefly_iii:6.0.0:alpha2::::::
	cpe:2.3:a:firefly-iii:firefly_iii:6.0.0:beta1::::::

References

Link	Resource
https://github.com/firefly-iii/firefly-iii/commit/6b05c0fbd3e8c40ae9b24dc2698821786fccf0c5	Patch
https://huntr.dev/bounties/2c3489f7-6b84-48f8-9368-9cea67cf373d	Permissions Required

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: @huntrdev

Published: 2023-04-01T00:00:00

Updated: 2023-04-01T00:00:00

Reserved: 2023-04-01T00:00:00

Link: CVE-2023-1789

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-04-01T02:15:07.203

Modified: 2023-04-07T01:24:04.447

Link: CVE-2023-1789

JSON object: View

Redhat Information

No data.

CWE

CWE-20

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:firefly-iii:firefly_iii:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FBE25F1-2ED5-4575-9027-AFDBB23E5C58", "versionEndExcluding": "5.7.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:firefly-iii:firefly_iii:5.8.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "67EA0D9B-349C-4AE4-B747-658A85A90801", "vulnerable": true}, {"criteria": "cpe:2.3:a:firefly-iii:firefly_iii:6.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "A2597736-BA8C-489E-91B6-80EB9010CF4D", "vulnerable": true}, {"criteria": "cpe:2.3:a:firefly-iii:firefly_iii:6.0.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "020B0289-B89A-470E-83E0-FD47D6C93F25", "vulnerable": true}, {"criteria": "cpe:2.3:a:firefly-iii:firefly_iii:6.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "7A7A2308-6695-4162-9DF9-8FAE1679DA47", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0."}], "id": "CVE-2023-1789", "lastModified": "2023-04-07T01:24:04.447", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 1.1, "impactScore": 3.7, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-01T02:15:07.203", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/firefly-iii/firefly-iii/commit/6b05c0fbd3e8c40ae9b24dc2698821786fccf0c5"}, {"source": "security@huntr.dev", "tags": ["Permissions Required"], "url": "https://huntr.dev/bounties/2c3489f7-6b84-48f8-9368-9cea67cf373d"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@huntr.dev", "type": "Primary"}]}