PT-2023-21398 · Rami.Io · Pretix

Published 2023-03-06 · Updated 2023-03-14 · CVE-2023-27891

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rami.io pretix versions prior to 4.15.1 rami.io pretix versions 4.15.1 through 4.16.0 rami.io pretix versions 4.16.1 through 4.17.0

Description The issue allows OAuth application authorization from a logged-out session.

Recommendations For versions prior to 4.15.1, update to version 4.15.1 or later. For versions 4.15.1 through 4.16.0, update to version 4.16.1 or later. For versions 4.16.1 through 4.17.0, update to version 4.17.1.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-27891

GHSA-R76W-3WWQ-JV6V

PYSEC-2023-42

Affected Products

Pretix

References · 9

• https://pretix.eu/about/en/blog/20230306-release-4171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27891 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-42 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r76w-3wwq-jv6v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27891 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2023-42.yaml · Note
• https://github.com/thufschmitt/pretix-nix · Note
• https://t.me/cvenotify/45665 · Telegram Post
• https://t.me/cibsecurity/59542 · Telegram Post