CVE-2023-37901

Summary

CVE-2023-37901 is a Cross-Site-Scripting (XSS) vulnerability affecting Indico, an open-source event management tool. This issue can be exploited when deleting content, requiring someone with submission privileges and another person attempting to delete this content. Considering the potential for external speakers, who may be untrusted, to submit content, the risk of successful attacks is significant. Event organizers using Indico for Call for Abstracts workflows are advised to update to version 3.2.6 immediately. Alternatively, they should limit submission privileges to trusted users.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.