Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0zd2c3LXI3cTUtcjJqZs4ABDcF

Indico Insecure Access

A Broken Object Level Authorization (BOLA) vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals.

Permalink: https://github.com/advisories/GHSA-3wg7-r7q5-r2jf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zd2c3LXI3cTUtcjJqZs4ABDcF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 1 day ago
Updated: 37 minutes ago

EPSS Percentage: 0.00043
EPSS Percentile: 0.1136

Identifiers: GHSA-3wg7-r7q5-r2jf, CVE-2024-50633
References:

Repository: https://github.com/cetinpy/CVE-2024-50633
Blast Radius: 0.0

Affected Packages

pypi:indico

Dependent packages: 21
Dependent repositories: 10
Downloads: 1,916 last month
Affected Version Ranges: >= 3.2.9, < 3.3.3
Fixed in: 3.3.3
All affected versions: 3.2.9, 3.3.1, 3.3.2
All unaffected versions: 0.98.0, 0.98.1, 0.98.2, 1.1.1, 1.1.2, 1.2.1, 1.2.2, 2.0.1, 2.0.2, 2.0.3, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 3.0.1, 3.0.2, 3.0.3, 3.1.1, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.3.3, 3.3.4, 3.3.5