Search for packages
| purl | pkg:pypi/indico@3.3.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3ev2-cjep-w3fd
Aliases: CVE-2024-45399 GHSA-rrqf-w74j-24ff PYSEC-2024-90 |
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the `next` URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass to version 0.5.5, which fixes the issue. Those who build the Indico package themselves and cannot upgrade can update the `flask-multipass` dependency to `>=0.5.5` which fixes the vulnerability. Otherwise one could configure one's web server to disallow requests containing a query string with a `next` parameter that starts with `javascript:`. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-02T04:21:45.997672+00:00 | Pypa Importer | Affected by | VCID-3ev2-cjep-w3fd | https://github.com/pypa/advisory-database/blob/main/vulns/indico/PYSEC-2024-90.yaml | 38.6.0 |