CVE-2024-8113

HIGH EPSS 22.0%
Published Aug 23, 20241y ago · Modified Jun 17, 20261w ago
7.2 CVSS 4.0
High
Find Similar
Published Aug 23, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.

CVSS Details

Base Score
7.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green
Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
22.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
pretixpretix* ≤2024.7.0

References 1

  • pretix.eu https://pretix.eu/about/en/blog/20240823-release-2024-7-1/
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.