Every CVE Search/ Get API key

CVE-2022-2514

Cross-site Scripting (XSS) - Reflected in beancount/fava

8.0 HighFix available

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.87%Unchanged since Jul 26, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.0

Cross-site Scripting (XSS) - Reflected in beancount/fava

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
CVE-2022-2514
CVSS 3.0
8.0 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2022-0100 8.0

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
EUVD-2022-0100
CVSS 3.0
8.0 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-xrf4-39fm-j5f2 5.3

Fava time and filter parameters vulnerable to reflected Cross-site Scripting

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected cross-site scripting due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
GHSA-xrf4-39fm-j5f2
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.1

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
CVE-2022-2514
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
8.0 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 8.0

Cross-site Scripting (XSS) - Reflected in beancount/fava

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
CVE-2022-2514
CVSS 3.0
8.0 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2022-2514 6.1

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
DEBIAN-CVE-2022-2514
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-xrf4-39fm-j5f2 5.3

Fava time and filter parameters vulnerable to reflected Cross-site Scripting

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected cross-site scripting due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
GHSA-xrf4-39fm-j5f2
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2022-43182 6.1

Withdrawn as duplicate of PYSEC-2022-239. The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
PYSEC-2022-43182
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2022-2514 6.1

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
UBUNTU-CVE-2022-2514
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
8.0 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVPYSEC-2022-239 No score

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.

Record
PYSEC-2022-239
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fava
PyPI
 before 1.22
1.22
fava
Debian:11
 All versions, plus listed versions
1.18-11.20.1-11.20.1-21.23.1+dfsg-11.23.1-11.30.2+dfsg-1
 None known
fava
PyPI
 before 1.22, plus listed versions
0.0.01.101.111.121.13
Show 16 moreShow less
1.141.151.161.171.181.191.201.20.11.211.31.41.51.61.71.81.9
1.22
fava
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.10-21.11-11.14-1
 None known
fava
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.18-11.20.1-1
 None known
fava
Ubuntu:25.10
 All versions, plus listed versions
1.30.2+dfsg-1
 None known
fava
Ubuntu:26.10
 All versions, plus listed versions
1.30.2+dfsg-1
 None known
fava
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.30.2+dfsg-1
 None known

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2514 is a high vulnerability (CVSS 8.0) in Beancount Beancount/fava, published July 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in fava 1.22.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open