CVE-2024-25635: IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/<userid> endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alf.ioto a version that resolves this vulnerability.Fixed in 2.0-M4-2402
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25635?
CVE-2024-25635 is classified as a medium severity vulnerability due to the potential exposure of sensitive user information.
How do I fix CVE-2024-25635?
To fix CVE-2024-25635, upgrade alf.io to version 2.0-Mr-2402 or later to mitigate the vulnerability.
What specific information is exposed by CVE-2024-25635?
CVE-2024-25635 allows organization owners to view API keys and user details of other organization owners.
Which versions of alf.io are affected by CVE-2024-25635?
Versions of alf.io prior to 2.0-Mr-2402 are affected by CVE-2024-25635.
What endpoint is exploited in CVE-2024-25635?
CVE-2024-25635 is exploited through the endpoint `http://192.168.26.128:8080/admin/api/users/<user_id>`.