GHSA-45rp-q25w-4426

pretix Stored Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-8113

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pretix	< 2024.7.1	2024.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-8113 advisory
https://github.com/pretix/pretix/commit/0f44a2ad4e170882dbe6b9d95dba6c36e4e181cf web
https://github.com/pretix/pretix package
https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2024-180.yaml web
https://pretix.eu/about/en/blog/20240823-release-2024-7-1 web