Project Firefly III has incorrect access control in the webhook management component
The advisory, in context
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 6.5.9 (inclusive)
No fix recorded for this interval.
409 explicitly affected versions
3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.10, 3.10.1, 3.10.2, 3.10.3, 3.10.4, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.4, 3.4.0.1, 3.4.0.10, 3.4.0.2, 3.4.0.3, 3.4.0.4, 3.4.0.5, 3.4.0.6, 3.4.0.7, 3.4.0.8, 3.4.0.9, 3.4.1, 3.4.10, 3.4.11, 3.4.2, 3.4.3, 3.4.4, 3.4.4.1, 3.4.4.2, 3.4.5, 3.4.6, 3.4.6.1, 3.4.7, 3.4.8, 3.4.9, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.6.1, 3.6.0, 3.6.1, 3.7.0, 3.7.1, 3.7.2, 3.7.2.1, 3.7.2.2, 3.7.2.3, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.9.0, 3.9.1, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.5.0, 4.6.0, 4.6.1, 4.6.10, 4.6.11, 4.6.11.1, 4.6.12, 4.6.13, 4.6.2, 4.6.3, 4.6.3.1, 4.6.4, 4.6.5, 4.6.6, 4.6.7, 4.6.8, 4.6.9, 4.7.0, 4.7.1, 4.7.1.1, 4.7.1.2, 4.7.1.3, 4.7.1.4, 4.7.10, 4.7.11, 4.7.12, 4.7.12.1, 4.7.13, 4.7.14, 4.7.15, 4.7.16, 4.7.17, 4.7.17.1, 4.7.17.2, 4.7.17.3, 4.7.17.4, 4.7.17.5, 4.7.17.6, 4.7.2, 4.7.2.1, 4.7.2.2, 4.7.3, 4.7.3.1, 4.7.3.2, 4.7.4, 4.7.5, 4.7.5.1, 4.7.5.2, 4.7.5.3, 4.7.6, 4.7.6.1, 4.7.6.2, 4.7.7, 4.7.8, 4.7.9, 4.8.0, 4.8.0.1, 4.8.0.2, 4.8.0.3, 4.8.1, 4.8.1.1, 4.8.1.2, 4.8.1.3, 4.8.1.4, 4.8.1.5, 4.8.1.6, 4.8.1.7, 4.8.1.8, 4.8.2, 4.8.2-alpha.1, 4.8.2-alpha.2, 4.8.2-alpha.3, 4.8.2-alpha.4, 4.8.2-alpha.5, 4.8.2-alpha.6, 4.8.2-beta.1, 4.8.2-beta.2, 4.8.3-alpha.1, 5.0.0, 5.0.0-alpha.1, 5.0.0-alpha.2, 5.0.0-beta.1, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.0-alpha.1, 5.1.0-beta.1, 5.1.1, 5.2.0, 5.2.0-alpha.1, 5.2.0-beta.1, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.3.0, 5.3.0-alpha.1, 5.3.0-beta.1, 5.3.0-beta.2, 5.3.1, 5.3.2, 5.3.3, 5.4.0, 5.4.0-alpha.1, 5.4.0-alpha.2, 5.4.0-alpha.3, 5.4.0-beta.1, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.5.0, 5.5.0-beta.1, 5.5.0-beta.2, 5.5.0-beta.3, 5.5.1, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.6.0, 5.6.0-alpha.1, 5.6.0-alpha.2, 5.6.1, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.7.10, 5.7.11, 5.7.12, 5.7.13, 5.7.14, 5.7.15, 5.7.16, 5.7.17, 5.7.18, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.7.8, 5.7.9, 5.8.0-alpha.1, 6.0.0-alpha.1, 6.0.0-alpha.2, 6.0.0-beta.1, 6.0.9, v6.0.0, v6.0.0-beta.2, v6.0.1, v6.0.10, v6.0.11, v6.0.12, v6.0.13, v6.0.14, v6.0.15, v6.0.16, v6.0.17, v6.0.18, v6.0.19, v6.0.2, v6.0.20, v6.0.21, v6.0.22, v6.0.23, v6.0.24, v6.0.25, v6.0.26, v6.0.27, v6.0.28, v6.0.29, v6.0.3, v6.0.30, v6.0.4, v6.0.5, v6.0.6, v6.0.7, v6.0.8, v6.1.0, v6.1.0-alpha.1, v6.1.1, v6.1.10, v6.1.11, v6.1.12, v6.1.13, v6.1.14, v6.1.15, v6.1.16, v6.1.17, v6.1.18, v6.1.19, v6.1.2, v6.1.20, v6.1.21, v6.1.22, v6.1.23, v6.1.24, v6.1.25, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.1.7, v6.1.8, v6.1.9, v6.2.0, v6.2.0-alpha.1, v6.2.0-alpha.2, v6.2.0-beta.1, v6.2.1, v6.2.10, v6.2.11, v6.2.12, v6.2.13, v6.2.14, v6.2.15, v6.2.16, v6.2.17, v6.2.18, v6.2.19, v6.2.2, v6.2.20, v6.2.21, v6.2.3, v6.2.4, v6.2.5, v6.2.6, v6.2.7, v6.2.8, v6.2.9, v6.3.0, v6.3.0-beta.1, v6.3.0-beta.2, v6.3.1, v6.3.2, v6.4.0, v6.4.1, v6.4.10, v6.4.11, v6.4.12, v6.4.13, v6.4.14, v6.4.15, v6.4.16, v6.4.17, v6.4.18, v6.4.19, v6.4.2, v6.4.20, v6.4.21, v6.4.22, v6.4.23, v6.4.3, v6.4.4, v6.4.5, v6.4.6, v6.4.7, v6.4.8, v6.4.9, v6.5.0, v6.5.1, v6.5.2, v6.5.3, v6.5.4, v6.5.5, v6.5.6, v6.5.7, v6.5.8, v6.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.5.9"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0",
"3.0.1",
"3.0.2",
"3.0.3",
"3.1",
"3.1.1",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.10",
"3.10.1",
"3.10.2",
"3.10.3",
"3.10.4",
"3.2.0",
"3.2.1",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.3",
"3.3.1",
"3.3.2",
"3.3.3",
"3.3.4",
"3.3.5",
"3.3.6",
"3.3.7",
"3.3.8",
"3.3.9",
"3.4",
"3.4.0.1",
"3.4.0.10",
"3.4.0.2",
"3.4.0.3",
"3.4.0.4",
"3.4.0.5",
"3.4.0.6",
"3.4.0.7",
"3.4.0.8",
"3.4.0.9",
"3.4.1",
"3.4.10",
"3.4.11",
"3.4.2",
"3.4.3",
"3.4.4",
"3.4.4.1",
"3.4.4.2",
"3.4.5",
"3.4.6",
"3.4.6.1",
"3.4.7",
"3.4.8",
"3.4.9",
"3.5.0",
"3.5.1",
"3.5.2",
"3.5.3",
"3.5.4",
"3.5.5",
"3.5.6",
"3.5.6.1",
"3.6.0",
"3.6.1",
"3.7.0",
"3.7.1",
"3.7.2",
"3.7.2.1",
"3.7.2.2",
"3.7.2.3",
"3.8.0",
"3.8.1",
"3.8.2",
"3.8.3",
"3.8.4",
"3.9.0",
"3.9.1",
"4.0.0",
"4.0.1",
"4.0.2",
"4.1.0",
"4.1.1",
"4.1.2",
"4.1.3",
"4.1.4",
"4.1.5",
"4.1.6",
"4.1.7",
"4.2.0",
"4.2.1",
"4.2.2",
"4.3.0",
"4.3.1",
"4.3.2",
"4.3.3",
"4.3.4",
"4.3.5",
"4.3.6",
"4.3.7",
"4.3.8",
"4.4.0",
"4.4.1",
"4.4.2",
"4.4.3",
"4.5.0",
"4.6.0",
"4.6.1",
"4.6.10",
"4.6.11",
"4.6.11.1",
"4.6.12",
"4.6.13",
"4.6.2",
"4.6.3",
"4.6.3.1",
"4.6.4",
"4.6.5",
"4.6.6",
"4.6.7",
"4.6.8",
"4.6.9",
"4.7.0",
"4.7.1",
"4.7.1.1",
"4.7.1.2",
"4.7.1.3",
"4.7.1.4",
"4.7.10",
"4.7.11",
"4.7.12",
"4.7.12.1",
"4.7.13",
"4.7.14",
"4.7.15",
"4.7.16",
"4.7.17",
"4.7.17.1",
"4.7.17.2",
"4.7.17.3",
"4.7.17.4",
"4.7.17.5",
"4.7.17.6",
"4.7.2",
"4.7.2.1",
"4.7.2.2",
"4.7.3",
"4.7.3.1",
"4.7.3.2",
"4.7.4",
"4.7.5",
"4.7.5.1",
"4.7.5.2",
"4.7.5.3",
"4.7.6",
"4.7.6.1",
"4.7.6.2",
"4.7.7",
"4.7.8",
"4.7.9",
"4.8.0",
"4.8.0.1",
"4.8.0.2",
"4.8.0.3",
"4.8.1",
"4.8.1.1",
"4.8.1.2",
"4.8.1.3",
"4.8.1.4",
"4.8.1.5",
"4.8.1.6",
"4.8.1.7",
"4.8.1.8",
"4.8.2",
"4.8.2-alpha.1",
"4.8.2-alpha.2",
"4.8.2-alpha.3",
"4.8.2-alpha.4",
"4.8.2-alpha.5",
"4.8.2-alpha.6",
"4.8.2-beta.1",
"4.8.2-beta.2",
"4.8.3-alpha.1",
"5.0.0",
"5.0.0-alpha.1",
"5.0.0-alpha.2",
"5.0.0-beta.1",
"5.0.1",
"5.0.2",
"5.0.3",
"5.0.4",
"5.0.5",
"5.1.0",
"5.1.0-alpha.1",
"5.1.0-beta.1",
"5.1.1",
"5.2.0",
"5.2.0-alpha.1",
"5.2.0-beta.1",
"5.2.1",
"5.2.2",
"5.2.3",
"5.2.4",
"5.2.5",
"5.2.6",
"5.2.7",
"5.2.8",
"5.3.0",
"5.3.0-alpha.1",
"5.3.0-beta.1",
"5.3.0-beta.2",
"5.3.1",
"5.3.2",
"5.3.3",
"5.4.0",
"5.4.0-alpha.1",
"5.4.0-alpha.2",
"5.4.0-alpha.3",
"5.4.0-beta.1",
"5.4.1",
"5.4.2",
"5.4.3",
"5.4.4",
"5.4.5",
"5.4.6",
"5.5.0",
"5.5.0-beta.1",
"5.5.0-beta.2",
"5.5.0-beta.3",
"5.5.1",
"5.5.10",
"5.5.11",
"5.5.12",
"5.5.13",
"5.5.2",
"5.5.3",
"5.5.4",
"5.5.5",
"5.5.6",
"5.5.7",
"5.5.8",
"5.5.9",
"5.6.0",
"5.6.0-alpha.1",
"5.6.0-alpha.2",
"5.6.1",
"5.6.10",
"5.6.11",
"5.6.12",
"5.6.13",
"5.6.14",
"5.6.15",
"5.6.16",
"5.6.2",
"5.6.3",
"5.6.4",
"5.6.5",
"5.6.6",
"5.6.7",
"5.6.8",
"5.6.9",
"5.7.0",
"5.7.1",
"5.7.10",
"5.7.11",
"5.7.12",
"5.7.13",
"5.7.14",
"5.7.15",
"5.7.16",
"5.7.17",
"5.7.18",
"5.7.2",
"5.7.3",
"5.7.4",
"5.7.5",
"5.7.6",
"5.7.7",
"5.7.8",
"5.7.9",
"5.8.0-alpha.1",
"6.0.0-alpha.1",
"6.0.0-alpha.2",
"6.0.0-beta.1",
"6.0.9",
"v6.0.0",
"v6.0.0-beta.2",
"v6.0.1",
"v6.0.10",
"v6.0.11",
"v6.0.12",
"v6.0.13",
"v6.0.14",
"v6.0.15",
"v6.0.16",
"v6.0.17",
"v6.0.18",
"v6.0.19",
"v6.0.2",
"v6.0.20",
"v6.0.21",
"v6.0.22",
"v6.0.23",
"v6.0.24",
"v6.0.25",
"v6.0.26",
"v6.0.27",
"v6.0.28",
"v6.0.29",
"v6.0.3",
"v6.0.30",
"v6.0.4",
"v6.0.5",
"v6.0.6",
"v6.0.7",
"v6.0.8",
"v6.1.0",
"v6.1.0-alpha.1",
"v6.1.1",
"v6.1.10",
"v6.1.11",
"v6.1.12",
"v6.1.13",
"v6.1.14",
"v6.1.15",
"v6.1.16",
"v6.1.17",
"v6.1.18",
"v6.1.19",
"v6.1.2",
"v6.1.20",
"v6.1.21",
"v6.1.22",
"v6.1.23",
"v6.1.24",
"v6.1.25",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.1.7",
"v6.1.8",
"v6.1.9",
"v6.2.0",
"v6.2.0-alpha.1",
"v6.2.0-alpha.2",
"v6.2.0-beta.1",
"v6.2.1",
"v6.2.10",
"v6.2.11",
"v6.2.12",
"v6.2.13",
"v6.2.14",
"v6.2.15",
"v6.2.16",
"v6.2.17",
"v6.2.18",
"v6.2.19",
"v6.2.2",
"v6.2.20",
"v6.2.21",
"v6.2.3",
"v6.2.4",
"v6.2.5",
"v6.2.6",
"v6.2.7",
"v6.2.8",
"v6.2.9",
"v6.3.0",
"v6.3.0-beta.1",
"v6.3.0-beta.2",
"v6.3.1",
"v6.3.2",
"v6.4.0",
"v6.4.1",
"v6.4.10",
"v6.4.11",
"v6.4.12",
"v6.4.13",
"v6.4.14",
"v6.4.15",
"v6.4.16",
"v6.4.17",
"v6.4.18",
"v6.4.19",
"v6.4.2",
"v6.4.20",
"v6.4.21",
"v6.4.22",
"v6.4.23",
"v6.4.3",
"v6.4.4",
"v6.4.5",
"v6.4.6",
"v6.4.7",
"v6.4.8",
"v6.4.9",
"v6.5.0",
"v6.5.1",
"v6.5.2",
"v6.5.3",
"v6.5.4",
"v6.5.5",
"v6.5.6",
"v6.5.7",
"v6.5.8",
"v6.5.9"
]
}