PT-2023-29245 · Pretix · Pretix

Published 2023-10-02 · Updated 2024-09-23 · CVE-2023-44463

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pretix versions prior to 2023.7.1

Description An issue was discovered in the application where incorrect parsing of configuration files causes it to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application.

Recommendations For versions prior to 2023.7.1, update to version 2023.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the trust of X-Forwarded-For headers until a patch is applied.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2023-44463

GHSA-J9GQ-W73W-9H6C

PYSEC-2023-187

Affected Products

Pretix

References · 14

• https://github.com/pretix/pretix/compare/v2023.7.0...v2023.7.1 · Patch
• https://github.com/pretix/pretix/commit/ccdce2ccb8207b82501af3c03f50abc0f819b469 · Patch
• https://osv.dev/vulnerability/GHSA-j9gq-w73w-9h6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44463 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-187 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44463 · Vendor Advisory
• https://github.com/pretix/pretix · Note
• https://github.com/pretix/pretix/tags · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2023-187.yaml · Note
• https://pretix.eu/about/en/blog/20230911-release-2023-7-1 · Note
• https://t.me/cibsecurity/71428 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1708977234986336593 · Twitter Post
• https://pretix.eu/about/en/ticketing · Note
• https://t.me/cvenotify/95698 · Telegram Post