Is CVE-2022-2514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-2514 being exploited in the wild.

How severe is CVE-2022-2514?

Medium severity, with a CVSS score of 6.1, published 26 July 2022.

Which products and versions are affected?

fava (PyPI) >= 0, < 1.22, ECOSYSTEM:introduced=0,fixed=1.22, GIT:introduced=0,fixed=ca9e3882c7b5fbf5273ba52340b9fea6a99f3711|ECOSYSTEM:introduced=0,fixed=1.22.

Is there a fix for CVE-2022-2514?

Yes. fava (PyPI): upgrade to 1.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-2514 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2022-2514?

Check whether you run fava (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-2514: Beancount Fava reflected XSS in time and filter parameters

Q: Which products and versions are affected?

fava (PyPI) >= 0, < 1.22, ECOSYSTEM:introduced=0,fixed=1.22, GIT:introduced=0,fixed=ca9e3882c7b5fbf5273ba52340b9fea6a99f3711|ECOSYSTEM:introduced=0,fixed=1.22.

Q: Is there a fix for CVE-2022-2514?

Yes. fava (PyPI): upgrade to 1.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2022-2514 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2022-2514?

Check whether you run fava (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-2514 · Severity: medium · CVSS 6.1 · Published 2022-07-26

Fava, a web interface for the Beancount accounting tool, is vulnerable to a security flaw where malicious code can be injected into the application. An attacker could trick a user into clicking a specially crafted link, allowing the attacker to execute scripts in the user's browser session. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technologies: fava (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-2514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-2514 being exploited in the wild.
How severe is CVE-2022-2514?: Medium severity, with a CVSS score of 6.1, published 26 July 2022.
Which products and versions are affected?: fava (PyPI) >= 0, < 1.22, ECOSYSTEM:introduced=0,fixed=1.22, GIT:introduced=0,fixed=ca9e3882c7b5fbf5273ba52340b9fea6a99f3711|ECOSYSTEM:introduced=0,fixed=1.22.
Is there a fix for CVE-2022-2514?: Yes. fava (PyPI): upgrade to 1.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-2514 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2022-2514?: Check whether you run fava (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fava (PyPI): upgrade to 1.22 or later
```
pip install "fava>=1.22"
```

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Fava prior to version 1.22. The vulnerability is located in the handling of 'time' and 'filter' parameters, where error messages containing these parameters were rendered in the UI without proper HTML escaping. An attacker can exploit this by crafting a malicious URL containing JavaScript and persuading a victim to visit it. The root cause was the use of the '|safe' filter in Jinja2 templates and a general lack of output encoding for error strings. Successful exploitation allows for arbitrary script execution in the context of the victim's browser. A fix is available in version 1.22 which removes unsafe template filters and ensures proper escaping.

Affected products

beancount fava < 1.22

Identifiers

CVE-2022-2514
GHSA-xrf4-39fm-j5f2
PYSEC-2022-239
PYSEC-2022-43182

Timeline

2022-07-25: advisory: NVD published CVE-2022-2514
2022-07-26: disclosed: GitHub Advisory published
2022-07-26: patched: Version 1.22 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.