This is the second round of releases from our Security Hunt. Please update Events Manager to 7.4.13, Events Manager Pro to 3.9.9 and our Stripe gateway to 2.5.3 as soon as you can.
The hunt has turned up 13 more confirmed issues since our last update, and these releases fix all of them. We’re keeping the details brief until sites have had time to update. If your Pro license has expired, free patches for older versions are on your security updates page, as they were last time.
You can see who’s in the lead on the scoreboard. The hunt runs until November 30, and whoever tops the board then wins a lifetime Pro license.
Our thanks to Greg on 30A, mercurystorm, HMF-IT, Benjamin Kincses and Waldo.
Changelog
Events Manager 7.4.13
- Security: Fixed a file handling vulnerability in the REST API, reported by Greg on 30A via the Security Hunt
- Security: Fixed an information disclosure vulnerability in the REST API, reported by Greg on 30A via the Security Hunt
- Security: Fixed an access control vulnerability affecting tickets, reported by Greg on 30A via the Security Hunt
- Security: Fixed an access control vulnerability in bookings, reported by mercurystorm via the Security Hunt
- Security: Fixed an information disclosure vulnerability affecting locations, reported by Benjamin Kincses via the Security Hunt
- Security: Fixed an information disclosure vulnerability in shortcodes, reported by mercurystorm via the Security Hunt
- Security: Fixed a vulnerability in booking withdrawals, reported by mercurystorm via the Security Hunt
- Security: Hardened remote image downloads in the REST API
Events Manager Pro 3.9.9
- Security: Fixed an information disclosure vulnerability in manual bookings, reported by HMF-IT via the Security Hunt
- Security: Fixed an access control vulnerability in waitlists, reported by HMF-IT via the Security Hunt
- Security: Fixed an XSS vulnerability in the admin area, reported by HMF-IT via the Security Hunt
- Security: Fixed an information disclosure vulnerability affecting locations, reported by HMF-IT via the Security Hunt
- Security: Hardened coupon handling at checkout
- Tweaked: Failed reCAPTCHA log entries no longer record the submitted form data
- Fixed: The release package left out the updated Dompdf library added in 3.9.6, so 3.9.6 to 3.9.8 downloads were rebuilt with it
Events Manager Pro Stripe Gateway 2.5.3
- Security: Fixed a payment validation vulnerability, reported by mercurystorm via the Security Hunt