CVE-2024-45300

HIGH

7.5

Descricao

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado9/6/2024

Ultima modificacao9/29/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

alf:alf

Fraquezas (CWE)

CWE-362CWE-362

Referencias

https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245(security-advisories@github.com)

https://github.com/alfio-event/alf.io/security/advisories/GHSA-67jg-m6f3-473g(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.