CVE-2024-25635: alf — Exploit & Fix

Description

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.

Is your site exposed to CVE-2024-25635?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-612 CWE-612

Affected Products

Vendor	Product	Versions
alf	alf	< 2.0-m4-2402

References

Advisories & Patches

https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f

Exploits

https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f https://github.com/alfio-event/alf.io/security/advisories/GHSA-ffr5-g3qg-gp4f

Frequently Asked Questions

What is CVE-2024-25635? +

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2024-25635? +

CVE-2024-25635 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-25635? +

CVE-2024-25635 affects products from alf, specifically: alf. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-25635? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-49071 6.5

Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized …

CVE-2025-57756 5.3

Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content …

CVE-2024-25628 7.6

Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the …

CVE-2024-45300 7.5

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a …

CVE-2024-25634 7.2

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. …

CVE-2024-45299 6.5

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the …

CVE-2024-25635