CVE-2024-8113: Stored XSS in Placeholder Samples in Mail Preview
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8113?
CVE-2024-8113 is classified as a low-severity stored XSS vulnerability in pretix.
How do I fix CVE-2024-8113?
To fix CVE-2024-8113, upgrade to pretix version 2024.7.1 or later.
What is stored XSS in the context of CVE-2024-8113?
Stored XSS in CVE-2024-8113 allows malicious event organizers to inject HTML tags into email previews in the settings page.
Which versions of pretix are affected by CVE-2024-8113?
Pretix versions up to 2024.7.0 are affected by CVE-2024-8113.
What impact does CVE-2024-8113 have on users?
The impact of CVE-2024-8113 is limited due to the default Content Security Policy in pretix, which mitigates script execution.