CVE-2024-25634 — IDOR make user can read e-mail log sent by other events
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted req…
Published: 2024-02-19 · CVSS: 7.2 · CVSS 3.1
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted request to receive the e-mail log sent by other events. Version 2.0-M4-2402 fixes this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7