cve/2024/CVE-2024-25634.md

### [CVE-2024-25634](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25634)
![](https://img.shields.io/static/v1?label=Product&message=alf.io&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.0-M4-2402%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-497%3A%20Exposure%20of%20Sensitive%20System%20Information%20to%20an%20Unauthorized%20Control%20Sphere&color=brighgreen)

### Description

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted request to receive the e-mail log sent by other events. Version 2.0-M4-2402 fixes this issue.

### POC

#### Reference
- https://github.com/alfio-event/alf.io/security/advisories/GHSA-5wcv-pjc6-mxvv

#### Github
No PoCs found on GitHub currently.