indico@1.9.11.dev16 vulnerabilities

indico is a conference lifecycle management and meeting/lecture scheduling tool.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via confirmation prompts. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content.

Upgrade indico to version 3.2.6 or higher.

indico is a conference lifecycle management and meeting/lecture scheduling tool.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization when using \href{}.

Upgrade indico to version 3.2.5 or higher.

indico is a conference lifecycle management and meeting/lecture scheduling tool.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in global announcement messages.

Upgrade indico to version 3.2.3 or higher.

indico is a conference lifecycle management and meeting/lecture scheduling tool.

Affected versions of this package are vulnerable to Improper Authorization which allows managers or coordinators to modify timetable entries or schedule contributions that not assigned to their session, and also to allow unauthorized users to access timetable entry details.

Upgrade indico to version 2.1.3 or higher.

indico is a conference lifecycle management and meeting/lecture scheduling tool.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the category picker (via category titles), location widget (via room and venue names defined by an Indico administrator) and the Indico Weeks View timetable theme (via contribution/break titles defined by an event organizer).

Upgrade indico to version 2.3.5 or higher.

indico is a conference lifecycle management and meeting/lecture scheduling tool.

Affected versions of this package are vulnerable to Open Redirect. The BASE_URL is not always enforced and requests whose Host header does not match are not rejected. Malicious actors can trick Indico into sending a password reset link to a user, that points to a host controlled by the attacker.

Upgrade indico to version 2.3.4 or higher.

indico is a conference lifecycle management and meeting/lecture scheduling tool.

Affected versions of this package are vulnerable to Information Exposure. Malicious users can run unsafe LaTeX commands on the server, which allows them to read local files (e.g. indico.conf). As far as is known it is not possible to write files or execute code using this vulnerability.

Upgrade indico to version 2.1.10, 2.2.3 or higher.