{"metadata": {"vulnerability": "cve-2024-45399", "count": 15, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2024-08-28T20:21:32.803Z", "date_only": false, "value": "2024-08-28T20:21:32.803Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2024-45399", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-09-04T17:19:14Z", "date_only": false, "value": "2024-09-04T17:19:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RRQF-W74J-24FF", "record": "GHSA-RRQF-W74J-24FF", "field": "published"}, {"timestamp": "2024-09-04T20:12:20.457Z", "date_only": false, "value": "2024-09-04T20:12:20.457Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-45399", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-09-04T20:12:20.457Z", "date_only": false, "value": "2024-09-04T20:12:20.457Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2024-45399", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-04T20:15:00Z", "date_only": false, "value": "2024-09-04T20:15:00+00:00", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2024-90", "record": "PYSEC-2024-90", "field": "published"}, {"timestamp": "2024-09-04T20:15:09Z", "date_only": false, "value": "2024-09-04T20:15:09Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RRQF-W74J-24FF", "record": "GHSA-RRQF-W74J-24FF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-09-04T20:15:09.257Z", "date_only": false, "value": "2024-09-04T20:15:09.257", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-45399", "record": "FKIE_CVE-2024-45399", "field": "published"}, {"timestamp": "2024-09-04T20:17:25.903Z", "date_only": false, "value": "2024-09-04T20:17:25.903426Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-45399", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-09-04T20:17:25.903Z", "date_only": false, "value": "2024-09-04T20:17:25.903426Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-45399", "record": "FKIE_CVE-2024-45399", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-09-04T20:17:38.298Z", "date_only": false, "value": "2024-09-04T20:17:38.298Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2024-45399", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-09-04T20:17:38.298Z", "date_only": false, "value": "2024-09-04T20:17:38.298Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-45399", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-04T22:47:17Z", "date_only": false, "value": "2024-09-04T22:47:17.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/4854", "record": "CVE-2024-45399", "field": "creation_timestamp", "uuid": "37880aec-0ba3-4e59-8491-1816f7425da9", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-45399 - Indico Cross-Site Scripting in Account Creation\", \n  \"Content\": \"CVE ID : CVE-2024-45399 \nPublished : Sept. 4, 2024, 8:15 p.m. | 27\u00a0minutes ago \nDescription : Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the `next` URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass to version 0.5.5, which fixes the issue. Those who build the Indico package themselves and cannot upgrade can update the `flask-multipass` dependency to `>=0.5.5` which fixes the vulnerability. Otherwise one could configure one's web server to disallow requests containing a query string with a `next` parameter that starts with `javascript:`. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"04 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/4854"}, {"timestamp": "2024-09-25T06:23:55.564Z", "date_only": false, "value": "2024-09-25T06:23:55.564403+00:00", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2024-90", "record": "PYSEC-2024-90", "field": "modified"}, {"timestamp": "2024-09-25T17:55:29Z", "date_only": false, "value": "2024-09-25T17:55:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RRQF-W74J-24FF", "record": "GHSA-RRQF-W74J-24FF", "field": "modified"}, {"timestamp": "2026-06-17T07:54:08.377Z", "date_only": false, "value": "2026-06-17T07:54:08.377", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-45399", "record": "FKIE_CVE-2024-45399", "field": "lastModified"}]}