CVE-2024-25627

Low

Description

Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.

SeverityLow

CVSS3.5

Exploit probability—

ProductAlf

PublishedFeb 16, 2024

First seenFeb 16, 2024

Weakness typeCWE-79Cross-site scripting (XSS)CWE-434Unrestricted upload of dangerous file type

How to fix

Update

alf alf2.0-m4-2304 or later

Affected products

Product	Affected versions	Fixed in
alf alf	v < 2.0-m4-2304	2.0-m4-2304

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.