Is CVE-2023-28458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-28458 being exploited in the wild.

How severe is CVE-2023-28458?

Low severity, with a CVSS score of 3.1, published 20 April 2023.

Which products and versions are affected?

pretalx (PyPI) ECOSYSTEM:introduced=2.3.1,fixed=2.3.2, GIT:introduced=0,fixed=60722c43cf975f319e94102e6bff320723776890|ECOSYSTEM:introduced=2.3.1,fixed=2.3.2.

Is there a fix for CVE-2023-28458?

Yes. pretalx (PyPI): upgrade to 2.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-28458 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2023-28458?

Check whether you run pretalx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-28458: pretalx path traversal in HTML export

CVE-2023-28458 · Severity: low · CVSS 3.1 · Published 2023-04-20

pretalx is an open-source conference management platform used to organize talks and schedules. A path traversal vulnerability in the HTML export feature allows organizers with administrative access to overwrite arbitrary files on the server with default error page content, potentially disrupting service or replacing important system files.

Technologies: pretalx (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2023-28458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-28458 being exploited in the wild.
How severe is CVE-2023-28458?: Low severity, with a CVSS score of 3.1, published 20 April 2023.
Which products and versions are affected?: pretalx (PyPI) ECOSYSTEM:introduced=2.3.1,fixed=2.3.2, GIT:introduced=0,fixed=60722c43cf975f319e94102e6bff320723776890|ECOSYSTEM:introduced=2.3.1,fixed=2.3.2.
Is there a fix for CVE-2023-28458?: Yes. pretalx (PyPI): upgrade to 2.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-28458 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2023-28458?: Check whether you run pretalx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pretalx (PyPI): upgrade to 2.3.2 or later
```
pip install "pretalx>=2.3.2"
```

Technical details

A path traversal vulnerability (CWE-22) exists in pretalx's static HTML export functionality, affecting version 2.3.1. The vulnerability is located in the export_schedule_html.py management command, where insufficient path sanitization allows authenticated organizers to specify arbitrary file paths during export. An attacker with organizer privileges can craft malicious export requests to overwrite files outside the intended export directory with the standard pretalx 404 page content. The vulnerability requires authentication as an organizer and is triggered via the HTML export feature (a non-default capability). A patch is available in version 2.3.2 and later.

Affected products

pretalx pretalx 2.3.1

Identifiers

CVE-2023-28458
GHSA-23fx-92m6-4f2g
PYSEC-2023-40

Timeline

2023-04-20: disclosed: GHSA-23fx-92m6-4f2g and CVE-2023-28458 published
2023-04-20: patched: Fix released in pretalx v2.3.2

References

https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff320723776890

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.