Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Indico may disclose unauthorized user details access via legacy API
Vulnerability Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
Indico 安全漏洞
Vulnerability Description
Indico是Indico开源的一个功能丰富的事件管理系统。 Indico 3.3.8之前版本存在安全漏洞，该漏洞源于访问检查不当，可能导致未经授权检索其他用户的个人资料。
CVSS Information
N/A
Vulnerability Type
N/A