Improper Input Validation in Firefly III

2021-09-0817:27:07

Google

osv.dev

0.0004 Low

EPSS

Percentile

12.8%

JSON

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.

CPENameOperatorVersion
grumpydictator/firefly-iiieq4.7.6.1
grumpydictator/firefly-iiieq3.8.3
grumpydictator/firefly-iiieq4.7.1.2
grumpydictator/firefly-iiieq4.3.7
grumpydictator/firefly-iiieq4.7.3
grumpydictator/firefly-iiieq4.7.15
grumpydictator/firefly-iiieq3.4.0.8
grumpydictator/firefly-iiieq3.8.2
grumpydictator/firefly-iiieq3.10.2
grumpydictator/firefly-iiieq3.4.6

Name	Operator	Version
grumpydictator/firefly-iii	eq	4.7.6.1
grumpydictator/firefly-iii	eq	3.8.3
grumpydictator/firefly-iii	eq	4.7.1.2
grumpydictator/firefly-iii	eq	4.3.7
grumpydictator/firefly-iii	eq	4.7.3
grumpydictator/firefly-iii	eq	4.7.15
grumpydictator/firefly-iii	eq	3.4.0.8
grumpydictator/firefly-iii	eq	3.8.2
grumpydictator/firefly-iii	eq	3.10.2
grumpydictator/firefly-iii	eq	3.4.6