CVE-2023-27891 Insufficient Session Expiration in pretix
Attackers can authorize OAuth applications from logged-out sessions, potentially leading to account takeover in pretix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-27891?
CVE-2023-27891 is a high-severity authentication bypass vulnerability in n/a, published on 6 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
Weakness: CWE-613
Which versions are affected by CVE-2023-27891?
7 open source packages ship an affected version, including pretix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pretix PyPI | All versions | 4.15.1 |
pretix PyPI | All versions | 4.15.1 |
pretix PyPI | All versions | 4.17.1 |
pretix PyPI | From 4.16.0 | 4.16.1 |
pretix PyPI | From 4.16.0 | 4.16.1 |
pretix PyPI | From 4.17.0 | 4.17.1 |
1 more packages
pretix PyPI | From 4.17.0 | 4.17.1 |
Products include Rami Pretix.
How do I fix CVE-2023-27891?
Upgrade pretix to a fixed version for your release line: 4.15.1, 4.17.1 or 4.16.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-27891 being exploited?
There is no known exploitation of CVE-2023-27891 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-r76w-3wwq-jv6v, PYSEC-2023-42.