漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Indico vulnerable to user enumeration via API endpoint
Vulnerability Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.
CVSS Information
N/A
Vulnerability Type
信息暴露
Vulnerability Title
Indico 安全漏洞
Vulnerability Description
Indico是Indico开源的一个功能丰富的事件管理系统。 Indico 3.3.7之前版本存在安全漏洞，该漏洞源于Flask-Multipass存在用户详细信息泄露。
CVSS Information
N/A
Vulnerability Type
N/A