PT-2024-31552 · Alf.Io · Alf.Io

Cbellone · Published 2024-09-06 · Updated 2024-09-30 · CVE-2024-45299

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions alf.io versions prior to 2.0-M5

Description The issue concerns an open source ticket reservation system for events. Prior to version 2.0-M5, the preloaded data as JSON is not escaped correctly. This allows an administrator or event admin to potentially break their own installation by inserting non-correctly escaped text. However, the Content-Security-Policy directive blocks any potential script execution. The texts for customization purposes are not properly escaped.

Recommendations For versions prior to 2.0-M5, update to version 2.0-M5 to resolve the issue. As a temporary workaround, consider avoiding the use of non-escaped text in customization to minimize the risk of installation breakage.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2024-45299

GHSA-MCX6-25F8-8RQW

Affected Products

Alf.Io

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45299.json · Exploit
• 🔥 https://github.com/alfio-event/alf.io/security/advisories/GHSA-mcx6-25f8-8rqw · Exploit
• https://github.com/alfio-event/alf.io/commit/e7131c588f4ac31067a41d0e31e6a6a721b2ff4b · Patch
• https://osv.dev/vulnerability/CVE-2024-45299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45299 · Security Note
• https://twitter.com/CVEnew/status/1832046403092357323 · Twitter Post
• https://t.me/cvenotify/96543 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1832068162990268923 · Twitter Post
• https://t.me/cvedetector/4962 · Telegram Post