medium6.9
CVE-2024-50633
Indico Insecure Access
Impact
A Broken Object Level Authorization (BOLA) vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | indico | >= 3.2.9, < 3.3.3 | 3.3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cern | Indico | from 3.2.9 through 3.3.2 |