CVE-2024-25627

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-25627
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-25627.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-25627
Aliases
  • GHSA-gpmg-8f92-37cf
Published
2024-02-16T20:27:58.176Z
Modified
2025-11-30T11:31:07.356797Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Cross-Site Scripting (XSS) via File Upload in Alf.io
Details

Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-434",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25627.json"
}
References

Affected packages

Git / github.com/alfio-event/alf.io

Affected ranges

Type
GIT
Repo
https://github.com/alfio-event/alf.io
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
73374a5e5af6d8e17d385b11e1759106602ef1f2

Affected versions

1.*

1.10
1.10-RC1
1.10-RC2
1.10.1
1.11
1.12
1.12-RC1
1.12-RC2
1.12-RC3
1.12-RC4
1.13
1.13-RC1
1.13-RC2
1.13-RC3
1.14
1.14-RC1
1.14-RC2
1.14.1
1.4
1.4-RC2
1.4.1
1.5
1.6
1.7
1.8
1.8-RC1
1.8-RC2
1.9
1.9.1

2.*

2.0-M0
2.0-M1
2.0-M1-1906
2.0-M1-1906.1
2.0-M2
2.0-M3
2.0-M4
2.0-M4-2204
2.0-M4-2301
2.0-M4.RC1
2.0-M4.RC2
2.0-M4.RC3
2.0-M4.RC4

alfio-1.*

alfio-1.0
alfio-1.1
alfio-1.2
alfio-1.3
alfio-1.3-beta1
alfio-1.3.1
alfio-1.3.2
alfio-1.3.3

v1.*

v1.0-pre-rename
v1.0-pre-rename-v2
v1.0-pre-rename-v3