Home > Vulnerability Database > CVE-2024-50633

Mend.io Vulnerability Database

CVE-2024-50633

Good to know:

Date: January 15, 2025

A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).

Severity Score

0.0

Related Resources (5)

Url: https://github.com/cetinpy/CVE-2024-50633/issues/1

Url: https://github.com/indico/indico

Url: https://github.com/cetinpy/CVE-2024-50633

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-50633

Url: https://www.mend.io/vulnerability-database/CVE-2024-50633

Weakness Type (CWE)

Missing Authorization

CWE-862

Insertion of Sensitive Information Into Sent Data

CWE-201

Authorization Bypass Through User-Controlled Key

CWE-639

Top Fix

Upgrade Version

Upgrade to version indico - 3.3.3

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE