id: PYSEC-2024-90
modified: 2024-09-25T06:23:55.564403Z
published: 2024-09-04T20:15:00Z
aliases:
- CVE-2024-45399
- GHSA-rrqf-w74j-24ff
details: Indico is an event management system that uses Flask-Multipass, a multi-backend
  authentication system for Flask. In Indico prior to version 3.3.4, corresponding
  to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability
  during account creation when redirecting to the `next` URL. Exploitation requires
  initiating the account creation process with a maliciously crafted link, and then
  finalizing the signup process. Because of this, it can only target newly created
  (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass
  to version 0.5.5, which fixes the issue. Those who build the Indico package themselves
  and cannot upgrade can update the `flask-multipass` dependency to `>=0.5.5` which
  fixes the vulnerability. Otherwise one could configure one's web server to disallow
  requests containing a query string with a `next` parameter that starts with `javascript:`.
affected:
- package:
    ecosystem: PyPI
    name: indico
    purl: pkg:pypi/indico
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 0bdcf656d469e5f675cb56fd644d82fea3a97c2a
    repo: https://github.com/indico/flask-multipass
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 7dcb573837b9fd09d95f74d1baeae225b164cc8f
    repo: https://github.com/indico/indico
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.3.4
  versions:
  - 0.98-rc1
  - 0.98.0
  - 0.98.1
  - 0.98.2
  - "0.99"
  - "1.0"
  - "1.1"
  - 1.1.1
  - 1.1.2
  - "1.2"
  - 1.2.1
  - 1.2.1rc10
  - 1.2.1rc11
  - 1.2.1rc2
  - 1.2.1rc4
  - 1.2.1rc5
  - 1.2.1rc6
  - 1.2.1rc7
  - 1.2.1rc9
  - 1.2.2
  - 1.2.2rc1
  - 1.9.11.dev10
  - 1.9.11.dev11
  - 1.9.11.dev12
  - 1.9.11.dev13
  - 1.9.11.dev14
  - 1.9.11.dev15
  - 1.9.11.dev16
  - 1.9.11.dev17
  - 1.9.11.dev3
  - 1.9.11.dev4
  - 1.9.11.dev6
  - 1.9.11.dev7
  - 1.9.11.dev8
  - 1.9.11.dev9
  - "2.0"
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0a1
  - 2.0rc1
  - 2.0rc2
  - "2.1"
  - 2.1.1
  - 2.1.10
  - 2.1.11
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.1.5
  - 2.1.6
  - 2.1.7
  - 2.1.8
  - 2.1.9
  - "2.2"
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.2.8
  - "2.3"
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.3.5
  - "3.0"
  - 3.0.1
  - 3.0.2
  - 3.0.3
  - 3.0rc1
  - 3.0rc2
  - "3.1"
  - 3.1.1
  - "3.2"
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2.4
  - 3.2.5
  - 3.2.6
  - 3.2.7
  - 3.2.8
  - 3.2.9
  - "3.3"
  - 3.3.1
  - 3.3.2
  - 3.3.3
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
references:
- type: ADVISORY
  url: https://github.com/indico/indico/security/advisories/GHSA-rrqf-w74j-24ff
- type: FIX
  url: https://github.com/indico/flask-multipass/commit/0bdcf656d469e5f675cb56fd644d82fea3a97c2a
- type: FIX
  url: https://github.com/indico/indico/commit/7dcb573837b9fd09d95f74d1baeae225b164cc8f
- type: WEB
  url: https://github.com/indico/indico/releases/tag/v3.3.4