CVE-2023-37901 Cross-Site-Scripting via confirmation prompts
Attackers can inject malicious scripts into confirmation prompts, potentially compromising user accounts when organizers delete suspicious content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-37901?
CVE-2023-37901 is a medium-severity cross-site scripting vulnerability in indico, published on 21 Jul 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content. Users need to update to Indico 3.2.6 as soon as possible. See the docs for instructions on how to update. Users who cannot upgrade should only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
Weakness: CWE-79
Which versions are affected by CVE-2023-37901?
3 open source packages ship an affected version, including indico. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
indico PyPI | All versions | 3.2.6 |
indico PyPI | All versions | 3.2.6 |
indico PyPI | All versions | 3.2.6 |
Products include Cern Indico.
How do I fix CVE-2023-37901?
Upgrade indico to 3.2.6 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-37901 being exploited?
There is no known exploitation of CVE-2023-37901 in the wild and no public exploit code.
Other vulnerabilities in indico
- CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection
- CVE-2021-30185 Indico Tampering with links (e.g. password reset) in sent emails
- CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places
- CVE-2026-28352 Indico missing access check in event series management API
- CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads
Sources
Also known as GHSA-fmqq-25x9-c6hm, PYSEC-2023-129.