PT-2023-21398 · Rami.Io · Pretix
CVE-2023-27891
·
Published
2023-03-06
·
Updated
2023-03-14
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
rami.io pretix versions prior to 4.15.1
rami.io pretix versions 4.15.1 through 4.16.0
rami.io pretix versions 4.16.1 through 4.17.0
Description
The issue allows OAuth application authorization from a logged-out session.
Recommendations
For versions prior to 4.15.1, update to version 4.15.1 or later.
For versions 4.15.1 through 4.16.0, update to version 4.16.1 or later.
For versions 4.16.1 through 4.17.0, update to version 4.17.1.
Exploit
Fix
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pretix