Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/grumpydictator/firefly-iii@6.0.8
Typecomposer
Namespacegrumpydictator
Namefirefly-iii
Version6.0.8
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version6.1.17
Latest_non_vulnerable_version6.5.1
Affected_by_vulnerabilities
0
url VCID-ceuu-cq6q-yke3
vulnerability_id VCID-ceuu-cq6q-yke3
summary C5 Firefly III CSV Injection.
references
0
reference_url https://github.com/firefly-iii/firefly-iii
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/firefly-iii/firefly-iii
1
reference_url https://github.com/advisories/GHSA-29w6-c52g-m8jc
reference_id GHSA-29w6-c52g-m8jc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-29w6-c52g-m8jc
2
reference_url https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-29w6-c52g-m8jc
reference_id GHSA-29w6-c52g-m8jc
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-29w6-c52g-m8jc
fixed_packages
0
url pkg:composer/grumpydictator/firefly-iii@6.1.7
purl pkg:composer/grumpydictator/firefly-iii@6.1.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kg26-nm7m-zyhs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/grumpydictator/firefly-iii@6.1.7
aliases GHSA-29w6-c52g-m8jc, GMS-2024-52
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ceuu-cq6q-yke3
1
url VCID-et4h-x9fk-93fv
vulnerability_id VCID-et4h-x9fk-93fv
summary Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-22075
reference_id
reference_type
scores
0
value 0.00128
scoring_system epss
scoring_elements 0.31777
published_at 2026-06-11T12:55:00Z
1
value 0.00128
scoring_system epss
scoring_elements 0.31965
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-22075
1
reference_url https://github.com/firefly-iii/firefly-iii
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/firefly-iii/firefly-iii
2
reference_url https://github.com/firefly-iii/firefly-iii/commit/28021aa711500bbada649de8fab9e72b4084ab21
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/firefly-iii/firefly-iii/commit/28021aa711500bbada649de8fab9e72b4084ab21
3
reference_url https://www.sonarsource.com/blog/front-end-frameworks-when-bypassing-built-in-sanitization-might-backfire
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.sonarsource.com/blog/front-end-frameworks-when-bypassing-built-in-sanitization-might-backfire
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-22075
reference_id CVE-2024-22075
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-22075
5
reference_url https://www.sonarsource.com/blog/front-end-frameworks-when-bypassing-built-in-sanitization-might-backfire/
reference_id front-end-frameworks-when-bypassing-built-in-sanitization-might-backfire
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-17T16:31:14Z/
url https://www.sonarsource.com/blog/front-end-frameworks-when-bypassing-built-in-sanitization-might-backfire/
6
reference_url https://github.com/advisories/GHSA-vwv2-9wcj-64vx
reference_id GHSA-vwv2-9wcj-64vx
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vwv2-9wcj-64vx
7
reference_url https://github.com/firefly-iii/firefly-iii/releases/tag/v6.1.1
reference_id v6.1.1
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-01-17T16:31:14Z/
url https://github.com/firefly-iii/firefly-iii/releases/tag/v6.1.1
fixed_packages
0
url pkg:composer/grumpydictator/firefly-iii@6.1.1
purl pkg:composer/grumpydictator/firefly-iii@6.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ceuu-cq6q-yke3
1
vulnerability VCID-kg26-nm7m-zyhs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/grumpydictator/firefly-iii@6.1.1
aliases CVE-2024-22075, GHSA-vwv2-9wcj-64vx
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-et4h-x9fk-93fv
2
url VCID-kg26-nm7m-zyhs
vulnerability_id VCID-kg26-nm7m-zyhs
summary Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an incrementing id, an attacker could try sign an OAuth application up to a users profile quite easily if they have created one. The attacker would also need to know the victims username and password. This problem has been patched in Firefly III v6.1.17 and up. Users are advised to upgrade. Users unable to upgrade should Use a unique password for their Firefly III instance and store their password securely, i.e. in a password manager.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-37893
reference_id
reference_type
scores
0
value 0.00028
scoring_system epss
scoring_elements 0.08491
published_at 2026-06-12T12:55:00Z
1
value 0.00028
scoring_system epss
scoring_elements 0.08452
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-37893
1
reference_url https://github.com/firefly-iii/firefly-iii
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/firefly-iii/firefly-iii
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-37893
reference_id CVE-2024-37893
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-37893
3
reference_url https://github.com/advisories/GHSA-4gm4-c4mh-4p7w
reference_id GHSA-4gm4-c4mh-4p7w
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4gm4-c4mh-4p7w
4
reference_url https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-4gm4-c4mh-4p7w
reference_id GHSA-4gm4-c4mh-4p7w
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-15T19:20:53Z/
url https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-4gm4-c4mh-4p7w
5
reference_url https://www.menlosecurity.com/what-is/highly-evasive-adaptive-threats-heat/mfa-bypass
reference_id mfa-bypass
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-15T19:20:53Z/
url https://www.menlosecurity.com/what-is/highly-evasive-adaptive-threats-heat/mfa-bypass
6
reference_url https://owasp.org/www-community/attacks/Password_Spraying_Attack
reference_id Password_Spraying_Attack
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-15T19:20:53Z/
url https://owasp.org/www-community/attacks/Password_Spraying_Attack
fixed_packages
0
url pkg:composer/grumpydictator/firefly-iii@6.1.17
purl pkg:composer/grumpydictator/firefly-iii@6.1.17
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/grumpydictator/firefly-iii@6.1.17
aliases CVE-2024-37893, GHSA-4gm4-c4mh-4p7w
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kg26-nm7m-zyhs
Fixing_vulnerabilities
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/grumpydictator/firefly-iii@6.0.8