PT-2024-31603 · Unknown+1 · Flask-Multipass+1

Thiefmaster · Published 2024-09-04 · Updated 2024-09-24 · CVE-2024-45399

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Indico versions prior to 3.3.4 Flask-Multipass versions prior to 0.5.5

Description: There is a Cross-Site-Scripting issue during account creation when redirecting to the next URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. This can only target newly created, and thus unprivileged, Indico users.

Recommendations: For Indico versions prior to 3.3.4, update to Indico 3.3.4 as soon as possible. For those who build the Indico package themselves and cannot upgrade, update the flask-multipass dependency to >=0.5.5. Otherwise, configure the web server to disallow requests containing a query string with a next parameter that starts with javascript:.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-1395

Related Identifiers

CVE-2024-45399

GHSA-RRQF-W74J-24FF

PYSEC-2024-90

Affected Products

Flask-Multipass

Indico

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45399.json · Exploit
• https://github.com/indico/indico/security/advisories/GHSA-rrqf-w74j-24ff · Vendor Advisory
• https://github.com/indico/indico/commit/7dcb573837b9fd09d95f74d1baeae225b164cc8f · Patch
• https://github.com/indico/flask-multipass/commit/0bdcf656d469e5f675cb56fd644d82fea3a97c2a · Patch
• https://osv.dev/vulnerability/PYSEC-2024-90 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45399 · Security Note
• https://osv.dev/vulnerability/GHSA-rrqf-w74j-24ff · Vendor Advisory
• https://github.com/indico/indico · Note
• https://github.com/indico/indico/releases/tag/v3.3.4 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/indico/PYSEC-2024-90.yaml · Note
• https://t.me/cvedetector/4854 · Telegram Post
• https://twitter.com/CVEnew/status/1831430439061615061 · Twitter Post
• https://t.me/cvenotify/95826 · Telegram Post