CVE-2024-45300

Katalog CVE

CVSS 5.9 · Medium EPSS 0,42%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada alf. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.

Rincian

Terbit di NVD

6 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/alfio-event/alf.io/security/advisories/GHSA-67jg-m6f3-473g exploit · advisory vendor
• https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245 patch