CVE-2025-59035

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59035", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-08T16:19:26.170Z", "datePublished": "2025-09-10T16:03:36.573Z", "dateUpdated": "2025-09-11T14:42:48.282Z"}, "containers": {"cna": {"title": "Indico vulnerable to Cross-Site Scripting via LaTeX math code", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/indico/indico/security/advisories/GHSA-7cf7-9wrr-vrf4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/indico/indico/security/advisories/GHSA-7cf7-9wrr-vrf4"}, {"name": "https://github.com/indico/indico/releases/tag/v3.3.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/indico/indico/releases/tag/v3.3.8"}], "affected": [{"vendor": "indico", "product": "indico", "versions": [{"version": "< 3.3.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-10T16:03:36.573Z"}, "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows."}], "source": {"advisory": "GHSA-7cf7-9wrr-vrf4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:26:59.952180Z", "id": "CVE-2025-59035", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:42:48.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59035", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:26:59.952180Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:27:04.115Z"}}], "cna": {"title": "Indico vulnerable to Cross-Site Scripting via LaTeX math code", "source": {"advisory": "GHSA-7cf7-9wrr-vrf4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "indico", "product": "indico", "versions": [{"status": "affected", "version": "< 3.3.8"}]}], "references": [{"url": "https://github.com/indico/indico/security/advisories/GHSA-7cf7-9wrr-vrf4", "name": "https://github.com/indico/indico/security/advisories/GHSA-7cf7-9wrr-vrf4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/indico/indico/releases/tag/v3.3.8", "name": "https://github.com/indico/indico/releases/tag/v3.3.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-10T16:03:36.573Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59035", "state": "PUBLISHED", "dateUpdated": "2025-09-11T14:42:48.282Z", "dateReserved": "2025-09-08T16:19:26.170Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-10T16:03:36.573Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "indico", "vendor": "indico", "versions": [{"status": "affected", "version": "< 3.3.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cern:indico:*:*:*:*:*:*:*:*", "matchCriteriaId": "9763A025-1F04-491A-AA56-DE5C785E7D05", "versionEndExcluding": "3.3.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows."}, {"lang": "es", "value": "Indico es un sistema de gesti\u00f3n de eventos que utiliza Flask-Multipass, un sistema de autenticaci\u00f3n multi-backend para Flask. Antes de la versi\u00f3n 3.3.8, existe una vulnerabilidad de Cross-Site-Scripting al renderizar c\u00f3digo matem\u00e1tico LaTeX en descripciones de contribuciones o res\u00famenes. Los usuarios deber\u00edan actualizar a Indico 3.3.8 lo antes posible. Como soluci\u00f3n alternativa, solo permita que usuarios de confianza creen contenido en Indico. Tenga en cuenta que una conferencia que realiza una Convocatoria de Res\u00famenes invita activamente a ponentes externos (a quienes los organizadores quiz\u00e1s no conozcan y, por lo tanto, no puedan confiar plenamente) a enviar contenido, de ah\u00ed la necesidad de actualizar a una versi\u00f3n corregida lo antes posible, en particular al utilizar dichos flujos de trabajo."}], "id": "CVE-2025-59035", "lastModified": "2026-06-17T09:45:28.573", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59035", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T14:26:59.952180Z", "version": "2.0.3"}}]}, "published": "2025-09-10T16:15:41.323", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/indico/indico/releases/tag/v3.3.8"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/indico/indico/security/advisories/GHSA-7cf7-9wrr-vrf4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-12T09:11:29.349074+00:00", "updated": "2025-09-12T09:11:29.349158+00:00", "vendors": ["cern", "cern$PRODUCT$indico"]}