CVE-2022-2523

Advisory

Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
The `query_string` parameter of Fava is vulnerable to reflected cross-site scripting, for which a attacker can modify any information that the user is able to modify. This issue is fixed in version 1.22.2.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-q8hg-3vqv-f8v3
• https://nvd.nist.gov/vuln/detail/CVE-2022-2523
• https://github.com/beancount/fava/commit/dccfb6a2f4567f35ce2e9a78e24f92ebf946bc9b
• https://github.com/beancount/fava
• https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-240.yaml
• https://huntr.dev/bounties/2a1802d8-1c2e-4919-96a7-d4dcf7ffcf8f
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2523