CVE-2024-25635
High
Description
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.
SeverityHigh
CVSS8.8
Exploit probability—
ProductAlf
PublishedFeb 19, 2024
First seenFeb 19, 2024
Weakness typeCWE-612CWE-612
How to fix
Update
- alf alf2.0-m4-2402 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alf alf | v < 2.0-m4-2402 | 2.0-m4-2402 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.