Back to Database
Status published
High
CVE-2024-25628
Insufficient Session Expiration in alf.io
Vulnerability Description
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-25628
Credits & Attribution
No credits recorded in the NVD database.
More from alfio-event
View All →CVE-2024-45300
Bypassing promo code limitations with race conditions
High
7.5
CVE-2024-45299
alf.io's preloaded data as json is not escaped correctly
Medium
6.5
CVE-2024-25635
IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
High
8.8
CVE-2024-25634
IDOR make user can read e-mail log sent by other events
High
7.2
CVE-2024-25627
Cross-Site Scripting (XSS) via File Upload in Alf.io
Low
3.5
Affected Vendor
alfio-event
View all reports →Affected Software
alf.io
Vulnerable Versions:
< 2.0-M4-2402
Timeline
Official Publish:
February 16th, 2024
Last Modified:
August 6th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H