Executive brief
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Affected products
- Packagist grumpydictator/firefly-iii
Junglewise Threat Intelligence
CVE-2021-3921: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3921 · Severity: low · CVSS 3 · Published 2021-11-15
Technologies: grumpydictator/firefly-iii (Packagist). Vendors: Packagist.
Related threats
- Project Firefly III SSRF in webhook management component
- Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
- Firefly III Stored XSS in Audit Log Entry via piggy bank name
- Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
- Firefly III has a MFA bypass in oauth flow