Skip to main content

Firefly Iii CVE-2023-0298

MEDIUM
Incorrect Authorization (CWE-863)
2023-01-14 security@huntr.dev
Authentication Bypass Firefly Iii
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jan 14, 2023 - 08:15 nvd
MEDIUM 6.5

DescriptionNVD

Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.

AnalysisAI

Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. Affected products include: Firefly-Iii Firefly Iii. Version information: prior to 5.8.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.

More in Firefly Iii

View all
CVE-2021-3901 HIGH POC
8.8 Oct 27

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-3846 HIGH POC
8.8 Oct 19

firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated high severity (CVSS 8.8), this vulne
CVE-2021-3819 HIGH POC
8.8 Sep 27

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-3663 HIGH POC
7.5 Jul 25

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts. Rated high severity (CVSS 7.5),

CVE-2021-3900 MEDIUM POC
6.5 Oct 27

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is

CVE-2021-3728 MEDIUM POC
6.5 Aug 23

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is

CVE-2019-14667 MEDIUM POC
6.1 Aug 05

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in

CVE-2023-1788 CRITICAL
9.8 Apr 05

Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6. Rated critical severity (CVSS 9
CVE-2023-1789 CRITICAL
9.8 Apr 01

Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0. Rated critical severity (CVSS 9.8
CVE-2021-3851 MEDIUM POC
5.4 Oct 19

firefly-iii is vulnerable to URL Redirection to Untrusted Site. Rated medium severity (CVSS 5.4), this vulnerability is

CVE-2019-14672 MEDIUM POC
5.4 Aug 05

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability na
CVE-2019-14670 MEDIUM POC
5.4 Aug 05

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name fi

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8
CVE-2024-38856 CRITICAL POC
9.8
CVE-2023-22518 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2023-0298 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy