Vulnerability · Published Jan 16, 2025 · Assigned by mitre
CVE-2024-50633
None 0.0
In plain English
A security flaw in Indico from CERN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | indico | 3.3.3 | GHSA-3wg7-r7q5-r2jf |
| PyPI | indico | 3.3.3 | PYSEC-2026-1459 |
Affected products (as reported)
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N