CVE-2024-45399 Indico has a Cross-Site-Scripting during account creation
Attackers can execute arbitrary scripts in the context of newly created Indico users via a malicious redirect link during account signup.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-45399?
CVE-2024-45399 is a medium-severity cross-site scripting vulnerability in indico, published on 4 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the `next` URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass to version 0.5.5, which fixes the issue. Those who build the Indico package themselves and cannot upgrade can update the `flask-multipass` dependency to `>=0.5.5` which fixes the vulnerability. Otherwise one could configure one's web server to disallow requests containing a query string with a `next` parameter that starts with `javascript:`.
Which versions are affected by CVE-2024-45399?
3 open source packages ship an affected version, including indico. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
indico PyPI | All versions | 3.3.4 |
indico PyPI | All versions | 3.3.4 |
indico PyPI | All versions | 3.3.4 |
Products include Cern Indico.
How do I fix CVE-2024-45399?
Upgrade indico to 3.3.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-45399 being exploited?
There is no known exploitation of CVE-2024-45399 in the wild and no public exploit code.
Other vulnerabilities in indico
- CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection
- CVE-2021-30185 Indico Tampering with links (e.g. password reset) in sent emails
- CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places
- CVE-2026-28352 Indico missing access check in event series management API
- CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads
Sources
Also known as GHSA-rrqf-w74j-24ff, PYSEC-2024-90.