PT-2024-21048 · Alf.Io · Alf.Io

Lujiefsi · Published 2024-02-16 · Updated 2024-12-18 · CVE-2024-25628

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Alf.io versions prior to 2.0-M4-2402

Description Alf.io is a free and open source event attendance management system. The issue allows users to access the admin area even after being invalidated or deleted. There are no known workarounds for this issue. All users are advised to upgrade to version 2.0-M4-2402 to address this issue.

Recommendations For versions prior to 2.0-M4-2402, upgrade to version 2.0-M4-2402 to resolve the issue. As a temporary workaround, consider restricting access to the admin area until the upgrade is applied.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2024-25628

GHSA-8P6M-MM22-Q893

Affected Products

Alf.Io

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25628.json · Exploit
• https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25628 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25628 · Vendor Advisory
• https://t.me/cvenotify/104789 · Telegram Post
• https://twitter.com/CVEnew/status/1758591575305953732 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1758636462835470574 · Twitter Post