PT-2024-21903 · Pretix · Pretix

Name of the Vulnerable Software and Affected Versions: pretix versions prior to 2024.1.1 Description: The issue is related to the mishandling of file validation. Recommendations: For versions prior to 2024.1.1, update to version 2024.1.1 or later to resolve the issue...

The vulnerability arises from insufficient checking of update files in the update folder of the VipNet Coordinator software protection system. This allows a perpetrator to execute arbitrary code.

The vulnerability of the VipNet Coordinator information protection software lies in insufficient checks on access rights to the update folder, as well as insufficient checks on the integrity and authenticity of update files. Exploiting this vulnerability could allow an attacker, operating locally...