Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. indico
  4. ›
  5. GHSA-rrqf-w74j-24ff

GHSA-rrqf-w74j-24ff: Indico has a Cross-Site-Scripting during account creation

September 4, 2024

There is a Cross-Site-Scripting vulnerability during account creation when redirecting after the account has been successfully created. Exploitation requires the user to initiate the account creation process with a maliciously crafted link, and then finalize the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users so the benefits of exploiting it are very limited.

References

  • github.com/advisories/GHSA-rrqf-w74j-24ff
  • github.com/indico/indico
  • github.com/indico/indico/commit/7dcb573837b9fd09d95f74d1baeae225b164cc8f
  • github.com/indico/indico/releases/tag/v3.3.4
  • github.com/indico/indico/security/advisories/GHSA-rrqf-w74j-24ff

Code Behaviors & Features

Detect and mitigate GHSA-rrqf-w74j-24ff with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.3.4

Fixed versions

  • 3.3.4

Solution

Upgrade to version 3.3.4 or above.

Impact 4.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Learn more about CVSS

Weakness

  • CWE-1395: Dependency on Vulnerable Third-Party Component
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Source file

pypi/indico/GHSA-rrqf-w74j-24ff.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:14:43 +0000.