GHSA-hjhp-hwfj-hwf3

GitHub Security Advisory

Cross Site Request Forgery in firefly-iii

✓ GitHub Reviewed MODERATE Has CVE

firefly-iii is vulnerable to a Cross-Site Request Forgery (CSRF) attack which can disable two factor authentication for the target user.

Packagist grumpydictator/firefly-iii

Affected versions: 0 (fixed in 5.6.5)

CVE-2021-4005

GHSA ID

GHSA-hjhp-hwfj-hwf3

Published

December 10, 2021 8:20 PM

Last Modified

December 6, 2021 9:43 PM

CVSS Score

5.0 /10

Primary Ecosystem

Packagist

Primary Package

grumpydictator/firefly-iii

GitHub Reviewed

✓ Yes

Last updated: July 12, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.