High severity · published Jan 16, 2025
CVE-2024-50633
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Indico · CERN
2.2 through 3.3.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-50633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-50633
Exploit
https://github.com/cetinpy/CVE-2024-50633
Issue Tracking
https://github.com/cetinpy/CVE-2024-50633/issues/1
More from Indico
8.8
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
7.5
CVE-2021-30185
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link
6.5
CVE-2026-28352
Indico missing access check in event series management API
6.5
CVE-2025-53640
Indico vulnerable to user enumeration via API endpoint
6.1
CVE-2024-45399
Indico has a Cross-Site-Scripting during account creation