CVE-2024-25635 - OpenCVE

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-02-19T19:48:10.379Z

Updated: 2024-08-28T18:02:07.113Z

Reserved: 2024-02-08T22:26:33.513Z

Link: CVE-2024-25635

Vulnrichment

Updated: 2024-08-01T23:44:09.642Z

NVD

Status : Awaiting Analysis

Published: 2024-02-19T20:15:45.890

Modified: 2024-02-20T19:50:53.960

Link: CVE-2024-25635

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25635", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-02-08T22:26:33.513Z", "datePublished": "2024-02-19T19:48:10.379Z", "dateUpdated": "2024-08-28T18:02:07.113Z"}, "containers": {"cna": {"title": "IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS", "problemTypes": [{"descriptions": [{"cweId": "CWE-612", "lang": "en", "description": "CWE-612: Improper Authorization of Index Containing Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f"}], "affected": [{"vendor": "alfio-event", "product": "alf.io", "versions": [{"version": "< 2.0-M4-2402", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-19T19:48:10.379Z"}, "descriptions": [{"lang": "en", "value": "alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue."}], "source": {"advisory": "GHSA-ffr5-g3qg-gp4f", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:44:09.642Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f"}]}, {"affected": [{"vendor": "alfio-event", "product": "alf.io", "cpes": ["cpe:2.3:a:alfio-event:alf.io:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.0-M4-2402", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-02-22T17:48:54.562344Z", "id": "CVE-2024-25635", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T18:02:07.113Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f", "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:44:09.642Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-25635", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-22T17:48:54.562344Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:alfio-event:alf.io:*:*:*:*:*:*:*:*"], "vendor": "alfio-event", "product": "alf.io", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0-M4-2402", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T18:01:59.581Z"}}], "cna": {"title": "IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS", "source": {"advisory": "GHSA-ffr5-g3qg-gp4f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "alfio-event", "product": "alf.io", "versions": [{"status": "affected", "version": "< 2.0-M4-2402"}]}], "references": [{"url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f", "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-612", "description": "CWE-612: Improper Authorization of Index Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-19T19:48:10.379Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25635", "state": "PUBLISHED", "dateUpdated": "2024-08-28T18:02:07.113Z", "dateReserved": "2024-02-08T22:26:33.513Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-02-19T19:48:10.379Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}