Stored XSS in Pretix's Organizer and Event Settings Could Allow Impersonation

CVE-2024-8113

What is CVE-2024-8113?

A stored cross-site scripting (XSS) vulnerability has been identified in the Pretix event management software. This flaw affects versions up to 2024.7.0, enabling malicious event organizers to inject HTML tags into email previews on the settings page. While the default Content Security Policy (CSP) implemented by Pretix prevents the execution of unauthorized scripts, the risk of exploitation exists, particularly in scenarios where a CSP bypass technique is utilized, posing a threat of impersonation against other organizers or staff members.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References