PT-2024-38809 · Pretix · Pretix

Published 2024-08-23 · Updated 2024-09-12 · CVE-2024-8113

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions: pretix versions up to 2024.7.0

Description: The issue allows malicious event organizers to inject HTML tags into e-mail previews on the settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass, the issue could be used to impersonate other organizers or staff users.

Recommendations: For versions up to 2024.7.0, update to a version later than 2024.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the organizer and event settings to minimize the risk of exploitation. Avoid using the affected settings page until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8113

GHSA-45RP-Q25W-4426

PYSEC-2024-180

Affected Products

Pretix

References · 12

• https://pretix.eu/about/en/blog/20240823-release-2024-7-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-45rp-q25w-4426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8113 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-180 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8113 · Vendor Advisory
• https://github.com/pretix/pretix · Note
• https://github.com/pretix/pretix/commit/0f44a2ad4e170882dbe6b9d95dba6c36e4e181cf · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2024-180.yaml · Note
• https://t.me/cvenotify/94407 · Telegram Post
• https://t.me/cvedetector/3993 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1827029456868741618 · Twitter Post
• https://twitter.com/CVEnew/status/1826995684333039781 · Twitter Post