PT-2025-2876 · Indico · Indico

Thiefmaster · Published 2025-01-10 · Updated 2025-01-21 · CVE-2024-50633

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Indico versions 3.2.9 through 3.3.5

Description A Broken Object Level Authorization (BOLA) issue allows attackers to read or access sensitive information by sending a crafted POST request to the "/api/principals" component. The supplier disputes this issue, stating that the product is designed to allow all users to retrieve certain information about other user accounts.

Recommendations For Indico versions 3.2.9 through 3.3.5, as a temporary workaround, consider restricting access to the "/api/principals" component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Missing Authorization

Weakness Enumeration

CWE-201

CWE-639

CWE-862

Related Identifiers

CVE-2024-50633

GHSA-3WG7-R7Q5-R2JF

Affected Products

Indico

References · 10

• 🔥 https://github.com/cetinpy/CVE-2024-50633/issues/1 · Exploit
• 🔥 https://github.com/cetinpy/CVE-2024-50633 · Exploit
• https://osv.dev/vulnerability/GHSA-3wg7-r7q5-r2jf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-50633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50633 · Security Note
• https://github.com/indico/indico · Note
• https://twitter.com/CVEnew/status/1880625665445421143 · Twitter Post
• https://t.me/cvedetector/15601 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1877756000536518703 · Twitter Post
• https://t.me/cvenotify/108026 · Telegram Post