alfio-event alf.io up to 2.0-M4 Content Security Policy escape output

Summaryinfo

A vulnerability described as problematic has been identified in alfio-event alf.io up to 2.0-M4. The affected element is an unknown function of the component Content Security Policy Handler. Such manipulation leads to escape output. This vulnerability is uniquely identified as CVE-2024-45299. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in alfio-event alf.io up to 2.0-M4. It has been rated as problematic. Affected by this issue is an unknown code block of the component Content Security Policy Handler. The manipulation with an unknown input leads to a escape output vulnerability. Using CWE to declare the problem leads to CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. Impacted is integrity, and availability. CVE summarizes:

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The Content-Security-Policy directive blocks any potential script execution. The administrator or event administrator can override the texts for customization purpose. The texts are not properly escaped. Version 2.0-M5 fixes this issue.

The advisory is available at github.com. This vulnerability is handled as CVE-2024-45299 since 08/26/2024. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 2.0-M5 eliminates this vulnerability. Applying the patch e7131c588f4ac31067a41d0e31e6a6a721b2ff4b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• alfio-event

Name

• alf.io

Version

• 2.0-M4

License

• open-source

Website

• Product: https://github.com/alfio-event/alf.io/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion