alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HAlf
APPAlf< 2.0-m5
Powiązane podatności
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view...
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data ...
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users ca...
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0...
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io ...