CVE-2024-25634
IDOR make user can read e-mail log sent by other events
Résumé
IDOR make user can read e-mail log sent by other events
Description d'origine
La description telle que publiée par la source (souvent en anglais).
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted request to receive the e-mail log sent by other events. Version 2.0-M4-2402 fixes this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov