Homepage
About Snyk

pretix@1.5.2 vulnerabilities

Reinventing presales, one ticket at a time

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the pretix package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • L
Cross-site Scripting (XSS)

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the control panel due to improper user input sanitization in the placeholders (like {name} or {event}). An attacker can inject HTML tags into email previews on the settings page by exploiting this vulnerability.

NOTE:

This is only exploitable if a Content Security Policy (CSP) bypass occurs.

How to fix Cross-site Scripting (XSS)?

Upgrade pretix to version 2024.7.1 or higher.

[,2024.7.1)
  • H
Improper Input Validation

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Improper Input Validation due to mishandling of file validation. An attacker can exploit this weakness by submitting a malicious file that bypasses the intended validation mechanisms.

How to fix Improper Input Validation?

Upgrade pretix to version 2024.1.1 or higher.

[,2024.1.1)
  • H
Arbitrary Code Injection

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Arbitrary Code Injection when parsing EPS files. An attacker can exploit this to execute arbitrary code by sending a specially crafted EPS file.

Note:

This is only exploitable if the application is configured to accept and parse EPS files.

How to fix Arbitrary Code Injection?

Upgrade pretix to version 2023.7.3 or higher.

[,2023.7.3)
Go back to all versions of this package