PT-2023-26171 · Indico · Indico

Thiefmaster · Publicado 2023-07-21 · Atualizado 2023-07-31 · CVE-2023-37901

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Indico versions prior to 3.2.6

Description There is a Cross-Site-Scripting issue in confirmation prompts used when deleting content from Indico. Exploitation requires someone with at least submission privileges and then someone else to attempt to delete this content. Event organizers may want to delete suspicious-looking content, posing a non-negligible risk of such an attack succeeding. This risk could be further increased with social engineering pointing the victim towards this content.

Recommendations For versions prior to 3.2.6, update to Indico 3.2.6 as soon as possible. For users who cannot upgrade, only let trustworthy users manage categories, create events, or upload materials.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-37901

GHSA-FMQQ-25X9-C6HM

PYSEC-2023-129

Produtos afetados

Indico

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37901.json · Exploit
• https://github.com/indico/indico · Nota
• https://github.com/indico/indico/security/advisories/GHSA-fmqq-25x9-c6hm · Aviso do Fabricante
• https://github.com/indico/indico/commit/2ee636d318653fb1ab193803dafbfe3e371d4130 · Correção
• https://github.com/indico/indico/releases/tag/v3.2.6 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/indico/PYSEC-2023-129.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-37901 · Nota de Segurança
• https://docs.getindico.io/en/stable/installation/upgrade · Nota
• https://osv.dev/vulnerability/CVE-2023-37901 · Aviso do Fabricante
• https://t.me/cibsecurity/67108 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-129 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fmqq-25x9-c6hm · Aviso do Fabricante