Description (CNA)
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| pretix / pretix | affected 0 through 2024.7.0 |
CWE
CWE-79
References
ADP enrichment
No English description supplied.
No references supplied.