pretix@3.9.0 vulnerabilities

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the control panel due to improper user input sanitization in the placeholders (like {name} or {event}). An attacker can inject HTML tags into email previews on the settings page by exploiting this vulnerability.

NOTE:

This is only exploitable if a Content Security Policy (CSP) bypass occurs.

Upgrade pretix to version 2024.7.1 or higher.

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Improper Input Validation due to mishandling of file validation. An attacker can exploit this weakness by submitting a malicious file that bypasses the intended validation mechanisms.

Upgrade pretix to version 2024.1.1 or higher.

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Authentication Bypass by Spoofing due to the incorrect parsing of configuration files. An attacker can spoof IP addresses by manipulating unchecked X-Forwarded-For headers.

Note:

This vulnerability is exploitable only if a reverse proxy config is used that allows the user to set these headers themselves and the config flags have been turned off explicitly.

Upgrade pretix to version 4.20.2.post1, 2023.6.1, 2023.7.1 or higher.

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Arbitrary Code Injection when parsing EPS files. An attacker can exploit this to execute arbitrary code by sending a specially crafted EPS file.

Note:

This is only exploitable if the application is configured to accept and parse EPS files.

Upgrade pretix to version 2023.7.3 or higher.

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Improper Authorization due to allowing OAuth application authorization from a logged-out session.

Note: Access to a browser (or session cookie) with a recent valid login into the system is required for the security problem to be exploitable. It is not possible for a remote attacker to use this to get access to random accounts.

Upgrade pretix to version 4.15.1, 4.16.1, 4.17.1 or higher.