CVE-2024-8113 Stored XSS in Placeholder Samples in Mail Preview
Malicious event organizers can inject HTML into email previews, potentially leading to account takeover if a CSP bypass exists.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-8113?
CVE-2024-8113 is a high-severity cross-site scripting vulnerability in pretix, published on 23 Aug 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.
Weakness: CWE-79
Which versions are affected by CVE-2024-8113?
3 open source packages ship an affected version, including pretix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pretix PyPI | All versions | 2024.7.1 |
pretix PyPI | All versions | 2024.7.1 |
pretix PyPI | All versions | 2024.7.1 |
Products include Pretix Pretix.
How do I fix CVE-2024-8113?
Upgrade pretix to 2024.7.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-8113 being exploited?
There is no known exploitation of CVE-2024-8113 in the wild and no public exploit code.
Other vulnerabilities in pretix
Sources
Also known as GHSA-45rp-q25w-4426, PYSEC-2024-180.