GitHub Advisoryadvisory · PyPI

GHSA-3wg7-r7q5-r2jf Indico Insecure Access

MEDIUM Published 2025-01-16 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-50633
Ecosystem
PyPI
Packages
indico
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Weaknesses
CWE-201, CWE-639, CWE-862
Reviewed
2025-01-16

Affected packages

• PyPI indico: >= 3.2.9, < 3.3.3 → fixed in 3.3.3

Description

A Broken Object Level Authorization (BOLA) vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals.

Related

Alias · CVE (1)

  • CVE-2024-50633 A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted… vulnerability

Weakness · CWE (3)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-862 Missing Authorization weakness

References