Alf.io Addresses Persistent XSS Vulnerability in Event Attendance Management System
CVE-2024-25627

4.8MEDIUM

Key Information:

Vendor

Alfio-event

Status
Alf.io
Vendor
CVE Published:
16 February 2024

What is CVE-2024-25627?

Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Version(s)

alf.io < 2.0-M4-2304

References

https://github.com/alfio-event/alf.io/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.