{"id":"GHSA-fmqq-25x9-c6hm","summary":"Indico vulnerable to Cross-Site-Scripting via confirmation prompts","details":"### Impact\nThere is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico.\nExploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content.\n\nConsidering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content.\n\n### Patches\nYou need to update to [Indico 3.2.6](https://github.com/indico/indico/releases/tag/v3.2.6) as soon as possible.\nSee [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.\n\n### Workarounds\nOnly let trustworthy users manage categories, create events or upload materials (\"submission\" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management.\n\nNote that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.\n\nFor more information\n\nIf you have any questions or comments about this advisory:\n\n* Open a thread in [our forum](https://talk.getindico.io/)\n* Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)","aliases":["CVE-2023-37901","PYSEC-2023-129"],"modified":"2024-09-23T17:29:03.846554Z","published":"2023-07-21T20:24:10Z","database_specific":{"github_reviewed_at":"2023-07-21T20:24:10Z","nvd_published_at":"2023-07-21T19:15:10Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/indico/indico/security/advisories/GHSA-fmqq-25x9-c6hm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37901"},{"type":"WEB","url":"https://github.com/indico/indico/commit/2ee636d318653fb1ab193803dafbfe3e371d4130"},{"type":"WEB","url":"https://docs.getindico.io/en/stable/installation/upgrade"},{"type":"PACKAGE","url":"https://github.com/indico/indico"},{"type":"WEB","url":"https://github.com/indico/indico/releases/tag/v3.2.6"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/indico/PYSEC-2023-129.yaml"}],"affected":[{"package":{"name":"indico","ecosystem":"PyPI","purl":"pkg:pypi/indico"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6"}]}],"versions":["0.98-rc1","0.98.0","0.98.1","0.98.2","0.99","1.0","1.1","1.1.1","1.1.2","1.2","1.2.1","1.2.1rc10","1.2.1rc11","1.2.1rc2","1.2.1rc4","1.2.1rc5","1.2.1rc6","1.2.1rc7","1.2.1rc9","1.2.2","1.2.2rc1","1.9.11.dev10","1.9.11.dev11","1.9.11.dev12","1.9.11.dev13","1.9.11.dev14","1.9.11.dev15","1.9.11.dev16","1.9.11.dev17","1.9.11.dev3","1.9.11.dev4","1.9.11.dev6","1.9.11.dev7","1.9.11.dev8","1.9.11.dev9","2.0","2.0.1","2.0.2","2.0.3","2.0a1","2.0rc1","2.0rc2","2.1","2.1.1","2.1.10","2.1.11","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","3.0","3.0.1","3.0.2","3.0.3","3.0rc1","3.0rc2","3.1","3.1.1","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-fmqq-25x9-c6hm/GHSA-fmqq-25x9-c6hm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}