nvd-json-data-feeds/CVE-2024/CVE-2024-81xx/CVE-2024-8113.json

{
  "id": "CVE-2024-8113",
  "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
  "published": "2024-08-23T15:15:17.593",
  "lastModified": "2024-09-12T18:21:30.677",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users."
    },
    {
      "lang": "es",
      "value": "El XSS almacenado en la configuraci\u00f3n del organizador y del evento con pretix hasta 2024.7.0 permite a organizadores de eventos maliciosos inyectar etiquetas HTML en vistas previas de correo electr\u00f3nico en la p\u00e1gina de configuraci\u00f3n. La pol\u00edtica de seguridad de contenido predeterminada de pretix impide la ejecuci\u00f3n de scripts proporcionados por atacantes, lo que hace que la explotaci\u00f3n sea poco probable. Sin embargo, combinada con una omisi\u00f3n del CSP (que actualmente no se conoce), la vulnerabilidad podr\u00eda usarse para hacerse pasar por otros organizadores o usuarios del personal."
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "USER",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "LOW",
          "providerUrgency": "GREEN"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ]
  },
  "weaknesses": [
    {
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "2024.7.0",
              "matchCriteriaId": "E6A18526-A03F-4E05-B43C-28A8CC2352A5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://pretix.eu/about/en/blog/20240823-release-2024-7-1/",
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}