XSS in Indico
CVE-2024-45399
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vul…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (74.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Affected products
- Indico — versions < 3.3.4
Weakness classification (CWE)
References
- https://github.com/indico/indico/security/advisories/GHSA-rrqf-w74j-24ff (x_refsource_CONFIRM)
- https://github.com/indico/flask-multipass/commit/0bdcf656d469e5f675cb56fd644d82fea3a97c2a (x_refsource_MISC)
- https://github.com/indico/indico/commit/7dcb573837b9fd09d95f74d1baeae225b164cc8f (x_refsource_MISC)
- https://github.com/indico/indico/releases/tag/v3.3.4 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-45399?
- CVE-2024-45399 is a medium-severity vulnerability in Indico, classified under Cross-site Scripting. CVSS score: 4.3/10. Published 2024-09-04.
- How severe is CVE-2024-45399?
- Medium severity. CVSS v3 base score is 4.3 out of 10.