Vulnerabilities

TI-2023-02119 CVE-2023-2260 · GHSA-2rcc-q9cg-9v38

Authorization Bypass Through User-Controlled Key in alfio-event/alf.io

MEDIUM 42

Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00859 Published 2023-04-24 Fixed in 2.0-M4-2304 CWE-639

TI-2023-02118 CVE-2023-2259 · GHSA-4w64-j7cg-53xc

HIGH 67

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01089 Published 2023-04-24 Fixed in 2.0-M4-2304 CWE-1336

TI-2023-02117 CVE-2023-2258 · GHSA-7rc3-9hxj-g7h2

MEDIUM 42

Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00913 Published 2023-04-24 Fixed in 2.0-M4-2304 CWE-1236