Stored XSS in Pretix's Organizer and Event Settings Could Allow Impersonation

CVE-2024-8113

What is CVE-2024-8113?

A stored cross-site scripting (XSS) vulnerability has been identified in the Pretix event management software. This flaw affects versions up to 2024.7.0, enabling malicious event organizers to inject HTML tags into email previews on the settings page. While the default Content Security Policy (CSP) implemented by Pretix prevents the execution of unauthorized scripts, the risk of exploitation exists, particularly in scenarios where a CSP bypass technique is utilized, posing a threat of impersonation against other organizers or staff members.

References