CVE-2024-50633
NONEIndico <3.3.5 - Info Disclosure
Title source: llmDescription
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).
Exploits (1)
Scores
EPSS
0.0901
EPSS Percentile
92.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Classification
CWE
CWE-201
Status
published
Affected Products (2)
cern/indico
< 3.3.2
pypi/indico
< 3.3.3PyPI
Timeline
Published
Jan 16, 2025
Tracked Since
Feb 18, 2026