{"id":"CVE-2024-45300","summary":"Bypassing promo code limitations with race conditions","details":"alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In \"alf.io\", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.","aliases":["GHSA-67jg-m6f3-473g"],"modified":"2026-08-12T14:52:14.154878Z","published":"2024-09-06T13:02:21.123Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-362"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45300.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45300.json"},{"type":"ADVISORY","url":"https://github.com/alfio-event/alf.io/security/advisories/GHSA-67jg-m6f3-473g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45300"},{"type":"FIX","url":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/alfio-event/alf.io","events":[{"introduced":"0"},{"fixed":"b69d9db08cd8b82ec82ad4d3d1673abc1aab68da"},{"fixed":"53b3309e26e8acec6860d1e045df3046153a3245"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:alf:alf:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.0-m5"}]}}],"versions":["2.0-M4-2304","2.0-M4-2301","2.0-M4-2204","2.0-M4","2.0-M4.RC4","2.0-M4.RC3","2.0-M4.RC2","2.0-M4.RC1","2.0-M3","2.0-M2","2.0-M1-1906","2.0-M1-1906.1","2.0-M1","2.0-M0","1.14.1","1.14","1.14-RC2","1.14-RC1","1.13","1.13-RC3","1.13-RC2","1.13-RC1","1.12","1.12-RC4","1.12-RC3","1.12-RC2","1.12-RC1","1.11","1.10.1","1.10","1.10-RC2","1.10-RC1","1.9.1","1.9","1.8","1.8-RC2","1.8-RC1","1.7","1.6","1.5","1.4.1","1.4","1.4-RC2","alfio-1.3.1","alfio-1.3","alfio-1.3-beta1","alfio-1.2","alfio-1.1","v1.0-pre-rename-v2","v1.0-pre-rename"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/manager/NotificationManager.java","function":"sendSimpleEmail"},"deprecated":false,"digest":{"function_hash":"24569641011850015556938362480232511014","length":796},"id":"CVE-2024-45300-0448bfe4","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"289549255417959895890216777803060981419","length":5166},"id":"CVE-2024-45300-2d3bc0aa","signature_type":"Function","signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/controller/api/v2/user/EventApiV2Controller.java","function":"getTicketCategories"}},{"deprecated":false,"digest":{"function_hash":"18776596485969336927029955104684939363","length":225},"id":"CVE-2024-45300-2faa7337","signature_type":"Function","signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/manager/PromoCodeRequestManager.java","function":"isDiscountCodeUsageExceeded"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/controller/api/v2/user/EventApiV2Controller.java"},"deprecated":false,"digest":{"line_hashes":["88090071358385220595115197344206327516","70654089265157778082847250426548230252","176282968009537451541766917768382426960","157660983955406307165238817210194690596"],"threshold":0.9},"id":"CVE-2024-45300-30945338"},{"source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/manager/TicketReservationManager.java","function":"isDiscountCodeUsageExceeded"},"deprecated":false,"digest":{"function_hash":"313272127952392731861846645924090151862","length":648},"id":"CVE-2024-45300-3999396f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/manager/PromoCodeRequestManager.java","function":"countUsage"},"deprecated":false,"digest":{"length":254,"function_hash":"276153733262488217207476439190167624302"},"id":"CVE-2024-45300-62b0eecc","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["252825181177395047555830291079653332202","223332685126425772323888005057379157681","230227248744937593511260974615201900499"],"threshold":0.9},"id":"CVE-2024-45300-6502d97d","signature_type":"Line","signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/manager/NotificationManager.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/repository/PromoCodeDiscountRepository.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["190850649917751270748283290702055934930","155631492101596156072295262860204694553","92743027025944695620359113184719157510","242364768212464882142271664171290238087","322364868762300011340117913468499859210","176962362624582102309263712022192089765","6245160788818234239033152113660452917","108733683239486887719165226257353093167","148691406934051006480078160021857317094","314402696043965986511447270436803984487","1792892976276942910438017178120913415","19014603997288266497819929794793010405"]},"id":"CVE-2024-45300-81798782"},{"target":{"file":"src/main/java/alfio/manager/TicketReservationManager.java","function":"createTicketReservation"},"deprecated":false,"digest":{"function_hash":"301545723513382653584117987316409041218","length":1801},"id":"CVE-2024-45300-8f0c16c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/manager/TicketReservationManager.java"},"deprecated":false,"digest":{"line_hashes":["196584488474195627230354102490241125554","259298864964421875313970304036935176700","134154385877721763982849475488829491035","87969124498916718594029476331253869664","314555529767739817617315071761703149782","193471032489033942976636343135092263890","121294480569674923354198553883793338606","283693287848284313539099475811387095085","245265339306958373312958473241970907521","161937833445334699188444014113408854161","5094272596083245237736070974583442010","313343399527451561448883683355880211182","304680882294938244244741017579562240372","140924166957594310921540717298868872671","145225866943946150955314142026339452304","97799077634307302450383777379470536442"],"threshold":0.9},"id":"CVE-2024-45300-aed6f74e"},{"signature_version":"v1","source":"https://github.com/alfio-event/alf.io/commit/53b3309e26e8acec6860d1e045df3046153a3245","target":{"file":"src/main/java/alfio/manager/PromoCodeRequestManager.java"},"deprecated":false,"digest":{"line_hashes":["243329760516757867532894019983415779769","163148070184793341232781815526501473235","35037845153274363604610985150618906072","114472878805464428897440640582513012019","180636262122214290265458574420052520521","107494428951485162809447935292805365943","32192906823188068729536414668620094608","212147491454286684091152457913634089135"],"threshold":0.9},"id":"CVE-2024-45300-c4d08aaf","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45300.json","vanir_signatures_modified":"2026-08-12T14:52:14Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}