CVE-2024-25627 - OpenCVE

Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-02-16T20:27:58.176Z

Updated: 2024-08-26T14:48:53.643Z

Reserved: 2024-02-08T22:26:33.512Z

Link: CVE-2024-25627

Vulnrichment

Updated: 2024-08-01T23:44:09.703Z

NVD

Status : Awaiting Analysis

Published: 2024-02-16T21:15:08.430

Modified: 2024-02-16T21:39:50.223

Link: CVE-2024-25627

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25627", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-02-08T22:26:33.512Z", "datePublished": "2024-02-16T20:27:58.176Z", "dateUpdated": "2024-08-26T14:48:53.643Z"}, "containers": {"cna": {"title": "Cross-Site Scripting (XSS) via File Upload in Alf.io", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf"}], "affected": [{"vendor": "alfio-event", "product": "alf.io", "versions": [{"version": "< 2.0-M4-2304", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-16T20:27:58.176Z"}, "descriptions": [{"lang": "en", "value": "Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-gpmg-8f92-37cf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:44:09.703Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf"}]}, {"affected": [{"vendor": "alfio-event", "product": "alf.io", "cpes": ["cpe:2.3:a:alfio-event:alf.io:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.0-m4-2304", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-02-20T19:09:42.887885Z", "id": "CVE-2024-25627", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T14:48:53.643Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf", "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:44:09.703Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-25627", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-20T19:09:42.887885Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:alfio-event:alf.io:*:*:*:*:*:*:*:*"], "vendor": "alfio-event", "product": "alf.io", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0-m4-2304", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T14:48:49.937Z"}}], "cna": {"title": "Cross-Site Scripting (XSS) via File Upload in Alf.io", "source": {"advisory": "GHSA-gpmg-8f92-37cf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "alfio-event", "product": "alf.io", "versions": [{"status": "affected", "version": "< 2.0-M4-2304"}]}], "references": [{"url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf", "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-16T20:27:58.176Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25627", "state": "PUBLISHED", "dateUpdated": "2024-08-26T14:48:53.643Z", "dateReserved": "2024-02-08T22:26:33.512Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-02-16T20:27:58.176Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}