CVE-2024-45300: fallo de gravedad alta en alfio-event alf.io
Bypassing promo code limitations with race conditions
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.4%
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
alfio-event · alf.ioCVEs relacionadas — alfio-event alf.io
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-25634HIGHIDOR make user can read e-mail log sent by other eventsEPSS 0.7%CVE-2024-45299MEDIUMalf.io's preloaded data as json is not escaped correctlyEPSS 0.7%CVE-2024-25635HIGHIDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERSEPSS 0.7%CVE-2024-25627LOWCross-Site Scripting (XSS) via File Upload in Alf.ioEPSS 0.4%CVE-2024-25628HIGHInsufficient Session Expiration in alf.ioEPSS 0.4%CVE-2026-50165HIGHalf.io has Improper Access Control for Organization Owners that Exposes System SecretsEPSS 0.4%