CVE-2022-2523: Fava vulnerable to Reflected Cross-site Scripting
(updated )
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
The query_string parameter of Fava is vulnerable to reflected cross-site scripting, for which a attacker can modify any information that the user is able to modify. This issue is fixed in version 1.22.2.
References
- github.com/advisories/GHSA-q8hg-3vqv-f8v3
- github.com/beancount/fava
- github.com/beancount/fava/commit/dccfb6a2f4567f35ce2e9a78e24f92ebf946bc9b
- github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-240.yaml
- huntr.dev/bounties/2a1802d8-1c2e-4919-96a7-d4dcf7ffcf8f
- nvd.nist.gov/vuln/detail/CVE-2022-2523
Code Behaviors & Features
Detect and mitigate CVE-2022-2523 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →